cockpit security update

An update is available for cockpit. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Cockpit enables users to administer GNU/Linux servers using a web browser. I...

CVE-2026-45431 Command Injection Vulnerability in GX Earth ONT Models

This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its web management interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary and executing OS commands on the targeted...

CVE-2026-3820

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process...

CVE-2026-49188

The aicmd utility executes with full root permissions. It pipes socket inputs directly to popen, paving the way for unauthenticated users to execute arbitrary root commands...

CVE-2026-49188 Elevated Root Command Execution via ai_cmd Sockets

The aicmd utility executes with full root permissions. It pipes socket inputs directly to popen, paving the way for unauthenticated users to execute arbitrary root commands...

CVE-2026-35906

T3 Technology CPE devices, specifically models T625Pro v1.0.07 , T6825G v1.0.03 , and T7281 v1.0.03 , are vulnerable to a critical Remote Code Execution (RCE) flaw. The root cause is an undocumented debug CGI endpoint that fails to properly neutralize special elements in HTTP query strings, allow...

PT-2026-46158

Name of the Vulnerable Software and Affected Versions Supermicro AS-2115HS-TNR affected versions not specified Description The SMTP service in the Supermicro BMC contains a command injection flaw. An attacker with administrator privileges can inject specially crafted characters into the SMTP...

PT-2026-46242

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string...

Cisco Catalyst SD-WAN Manager security vulnerabilities

Cisco Catalyst SD-WAN Manager is a highly customizable dashboard provided by Cisco. It simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. There is a security vulnerability present in Cisco Catalyst SD-WAN Manager, which stems from insufficient user...

CVE-2026-49190: Improper Neutralization of Special Elements used in an OS Command

The system fails to evaluate instructional permissions over multiple internal operation codes opcodes, permitting unauthorized application installations or command executions...

1C:Library of Standard Subsystems Command Execution

The vulnerability of the developer tool “1C:Standard Subsystems Library” relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the server user remotely...

D-Link DI-7001 MINI Router sprintf Buffer Overflow DoS

The vulnerability of the sprintf function in the /httpddebug.asp file of the D-Link DI-7001 MINI router’s microprogramming system is related to the execution of operations outside the buffer in memory when processing the time parameter. Exploiting this vulnerability allows a remote attacker to...

TRENDnet TEW-432BRP Router Arbitrary Command Execution

The vulnerability of the formSetRoute function in the /goform/formSetRoute file of the TRENDnet TEW-432BRP router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow a remote attacker to...

UniFi OS Server Arbitrary Command Execution

The vulnerability of the UniFi OS Server network management center is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

UniFi OS Server Arbitrary Command Execution

The vulnerability of the UniFi OS Server network management center is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

TRENDnet TEW-432BRP Form WPS Command Execution

The vulnerability of the formWPS function in the /goform/formWPS file of TRENDnet TEW-432BRP microprogramming router software is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow a remote attacker to execute arbitrar...

CVE-2026-35906: Improper Neutralization of Special Elements used in an OS Command

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string...

RockyLinux 10 : cockpit (RLSA-2026:21676)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21676 advisory. cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI CVE-2026-4802 Tenable has extracted the preceding description block directly...

EUVD-2024-55605

launch-editor vulnerable to command injection via the crafted request on Windows...

MAL-2026-5182 Malicious code in brave-search-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7d65e78a73a4cc2064d0ab9210a76c7c55f69553b70879dd649d7ad84e48dc0 The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 npm as malicious. It is considered malicious because: - The...