CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1792771843)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792771843 advisory. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed b...

PT-2026-123148

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load param in txt of the file python/src/nnabla/utils/cli/encode decode param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to laun...

Continue command injection vulnerability

Version 2.0.0 contains a command injection vulnerability. This vulnerability stems from improper handling of the file core/config/ConfigHandler.ts by the MCPManagerSingleton.setConnections function within the MCP Server Transport component, potentially leading to OS command injection...

EUVD-2026-109963

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

CVE-2026-36698

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

Mirth Connect 4.4.0 Remote Command Execution

NextGen Healthcare Mirth Connect versions before version 4.4.1 contain an unauthenticated remote code execution vulnerability. This proof of concept submits a crafted XML deserialization payload to execute a command on an affected target. https://packetstorm.news/download/237649...

PT-2026-125382

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched...

CVE-2025-13833: Improper Certificate Validation

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...

Alex Andru docker-mcp command injection vulnerability

Versions 0.1.0 and 0.2.0 of Alex Andru’s docker-mcp contain a command injection vulnerability. This vulnerability stems from improper handling of the projectname parameter in the buildwindowscommand function within the dockerexecutor.py file, potentially allowing remote execution of OS commands v...

PT-2026-123165

A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public a...

Dolibarr command injection vulnerability

Versions of Dolibarr prior to 24.0.0 contain a command injection vulnerability. This vulnerability stems from an OS command injection issue in htdocs/admin/tools/export.php. Authenticated administrators can bypass the restrictoscommands allow list by crafting mysqldump values and using & characte...

PT-2026-123155

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-36698

Xovis AG APS-R-POE , APS-R-POE-PP , APS-R , APS-R-POE-USB , and APS-B (version 2.10.1.1 and earlier) are vulnerable to an OS command injection vulnerability (CWE-78) in the /sbin/ImportParamSet.sh script. The flaw exists because the script processes symlinks from uploaded parameter archive files ...

Linux Distros Unpatched Vulnerability : CVE-2026-116053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function sourcespecialcommandissafe of the file...

PT-2026-123447

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

PT-2026-125127

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...

Vertiv Avocent ACS8000 command injection vulnerability

Vertiv Avocent ACS8000 versions 2.32.4 and earlier contain a command injection vulnerability. This vulnerability arises because the wsserver terminal bridge daemon, which runs with root privileges, constructs shell commands from WebSocket fields provided by clients and passes them to the system a...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792689093)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792689093 advisory. - A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in...

RHEL 9 : lrzsz (RHSA-2026:89755)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89755 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792745817)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792745817 advisory. - A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the...