RLSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

RLSA-2026:86970 Moderate: cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a flaw in the affected interfaces, allowing unauthenticated remote attackers to perform SQL injection attacks on AOS-8 instances. Exploitation of this vulnerability enables arbitrary commands to be executed at the operating system leve...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a flaw in authentication mechanisms on affected interfaces, allowing unauthenticated remote attackers to bypass existing authentication checks and execute arbitrary commands on the underlying host. Successful exploitation of this...

Microsoft Azure Pipelines command injection vulnerability

Microsoft Azure Pipelines has a command injection vulnerability. This vulnerability stems from improper neutralization of special elements within commands, potentially allowing unauthenticated attackers to execute code over the network...

PT-2026-121629

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description Command injection flaws exist that allow unauthenticated remote code execution. An attacker can achieve this by sending specially crafted PAPI packets, enabling the execution of arbitrary code ...

PT-2026-120952

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in th...

Dell Alienware Command Center < 6.14.54.0 Least Privilege Violation (DSA-2026-418)

The version of Dell Alienware Command Center AWCC installed on the remote host is prior to 6.14.54.0. It is, therefore, affected by a least privilege violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileg...

Linux Distros Unpatched Vulnerability : CVE-2026-111079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 has a security vulnerability stemming from the lack of input validation on affected interfaces. Privileged remote attackers can exploit this flaw to perform command injection attacks, potentially executing commands with elevated privileges on the underlying operating system...

PT-2026-121596

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A command injection issue exists in the PAPI protocol, which is used for access point management. An unauthenticated attacker can achieve remote code execution by sending specially crafted...

Rocky Linux 9.6 [TuxCare] Security Update: gdb / gdb-doc / gdb-gdbserver / gdb-headless / gdb-minimal (ALMALINUX9.6:CLSA-2026:1792625564)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792625564 advisory. - A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal b...

Rocky Linux 10.2 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_86056)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

PT-2026-120890

Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG version 4.1.2cu.5268 B20221104 Description A remote command injection flaw exists in the UploadCustomModule function within the lib/cste modules/product.so file. This issue occurs when the FileMd5 argument is manipulated,...

AlmaLinux 9.6 [TuxCare] Security Update: gdb / gdb-doc / gdb-gdbserver / gdb-headless / gdb-minimal (ALMALINUX9.6:CLSA-2026:1792625564)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792625564 advisory. - A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug...

KiloView E3 firmware command injection vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a command injection vulnerability. This flaw arises because the hostname parameter received by the device’s naming endpoint is passed directly into shell commands without proper quotation marks. As a result, authenticated web users may...

Linux Distros Unpatched Vulnerability : CVE-2026-96639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

Amazon AWS SAM CLI command injection vulnerability

Versions of Amazon AWS SAM CLI prior to 1.166.2 contain a command injection vulnerability. This vulnerability stems from OS command injection within Terraform hooks; attackers can influence the Terraform configuration or plan files used during builds. By using specially crafted Terraform resource...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from the fact that input is not properly validated on affected interfaces. Remote attackers with elevated privileges can exploit this flaw to perform command injection attacks, potentially executing arbitrary commands as a privileged user o...