PT-2026-120182

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRP...

Rocky Linux 9 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_84594)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202684594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable has...

ALSA-2026:86970 Moderate: cockpit-machines security update

Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...

PT-2026-120556

CISA's Oct 20 ICS batch included WAGO CC100/PFC100/PFC200 G2 controllers: OS command injection CVE-2026-80466 CVSS 8.8, fixed in firmware 4.10.0. No known exploitation. CISA has since pulled the advisory page. CISA https://t.co/TsmiXvyZGV ICS...

RHEL 10 : goose (RHSA-2026:80765)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80765 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to:...

RockyLinux 10 : lrzsz (RLSA-2026:86056)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

TastyIgniter deserialization injection vulnerability

TastyIgniter versions 4.4.5 and earlier contain a deserialization injection vulnerability. This flaw arises because setting values are not properly sanitized when stored; upon retrieval via getValueAttribute, they are deserialized, leading to PHP object injection. Attackers can submit a serialize...

ROS-20261021-73-0061

The vulnerability in MongoDB-Compass is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

smub Duplicator deserialization injection vulnerability

Smub Duplicator versions 1.5.17 and earlier, as well as Duplicator Pro versions 4.6.10 and earlier, contain a deserialization injection vulnerability. This vulnerability arises because during migration, DUPXUpdateEngine::unserializeTest deserializes untrusted database contents, leading to PHP...

Qingteng Host Adaptive Security Platform command injection vulnerability

Versions of the Qingteng Host Adaptive Security Platform prior to 20260929 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing authenticated console administrators to execute arbitrary commands on...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection in compose branch fields. The proof of concept stores a crafted branch value, triggers deployment, and confirms execution from deployment logs. https://packetstorm.news/download/236744...

AlmaLinux 10 : lrzsz (ALSA-2026:86056)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Fedora 44 : dolphin (2026-85f07f4f1b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory. - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the preceding description block directly from the Fedora security...

AlmaLinux 10 : emacs (ALSA-2026:84591)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filename...

PT-2026-120534

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminati...

MCPJam Inspector 1.4.2 Remote Command Execution

MCPJam Inspector version 1.4.2 and earlier contains a remote command execution vulnerability. The proof of concept sends a crafted server configuration to the MCP connection endpoint. https://packetstorm.news/download/236732...

PT-2026-120287

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...

Dokploy 0.29.12 Compose Branch Command Injection

Dokploy versions 0.29.3 through 0.29.12 contain a command injection vulnerability in compose branch fields. This proof of concept demonstrates authenticated arbitrary command execution through compose deployment. https://packetstorm.news/download/236749...

RHEL 10 : lrzsz (RHSA-2026:86056)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

PT-2026-120898

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...