150170 matches found
OESA-2026-3103 qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code ...
OESA-2026-3102 qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code ...
SUSE CVE-2026-15793
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...
SUSE CVE-2026-16493
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
SUSE CVE-2026-63850
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...
EUVD-2026-48434
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
PT-2026-64263
Name of the Vulnerable Software and Affected Versions SUNNET Corporate Training Management System versions prior to 10.4 Description The e-paper draft upload function contains a flaw that allows remote authenticated users with administrator privileges to execute arbitrary commands. This is achiev...
Important: nvidia-kmod-common
Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code...
Important: nvlink5
Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code...
Important: nvidia-xconfig
Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code...
PT-2026-64371
Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates. This occurs because the Twig environment in the TwigView::render...
PT-2026-64235
Exim before 4.99.5 allows .forward privilege escalation because force command for a pipe transport is mishandled...
PT-2026-64451
Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.8.0 Description A double free error occurs when an authenticated attacker executes the RESTORE command. This happens when a RESTORE payload references the same NACK pending entry across multiple consumers, and both...
CVE-2026-16763
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
CVE-2026-16796
Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...
CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
CVE-2026-16763
CVE-2026-16763 affects localstack serverless-localstack up to version 1.4.0. The vulnerability targets an unknown function in src/index.js of the Configuration Handler, where manipulating the argument custom.localstack.docker.compose_file enables local OS command injection. The CVE describes loca...
CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
DEBIAN-CVE-2026-60122
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...
CVE-2026-60122
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...