PT-2026-128070

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-86394: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

CVE-2026-86396: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

FasterXML Jackson-Databind deserialization injection vulnerability

A deserialization injection vulnerability exists in FasterXML Jackson-Databind versions from 2.10.0 up to 2.18.12, from 2.19.0 up to 2.21.8, from 2.22.0 up to 2.22.4, from 3.0.0 up to 3.1.8, and from 3.2.0 up to 3.2.4. This vulnerability arises because external classes are validated for their...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146695)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146695 advisory. In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts...

PT-2026-129213

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0 Description An unauthenticated remote attacker can achieve operating-system command execution as the web-server user. The issue exists in the live-streaming endpoint view/videosListToLive.php, which accepts an...

DEBIAN-CVE-2026-118355

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118355

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118355

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118355

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118355

Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118355

A high-severity improper input validation flaw exists in the Command component of Google Chrome (prior to version 156.0.8078.73 ). A remote attacker could exploit this vulnerability by serving a crafted HTML page to a victim, potentially leading to arbitrary code execution outside the sandbox. Im...

Exploit for CVE-2026-118238

Tenda W18E - Unauthenticated Root Command Injection diagnose...

convoC2

convoC2 Table of Contents Introduction Demo Usage Requirements Inspiration Contribute Introduction Command and Control infrastructure that allows Red Teamers to execute system commands on compromised hosts through Microsoft Teams. It infiltrates data into hidden span tags in Microsoft Teams...

GHSA-RJH2-4XGW-P2HJ Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

CVE-2026-112351

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112352

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112352

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to an authentication bypass due to a lack of validation and integrity protection on session cookies. An unauthenticated remote attacker can impersonate any user with an active session by forging a cookie containing a cleartext username, suc...

CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...