156863 matches found
Exploit for CVE-2026-6837
CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection T...
PT-2026-73175
Name of the Vulnerable Software and Affected Versions Edimax EW-7478APC version 1.04 Description Remote command injection is possible through the manipulation of the rootAPmac argument within the formWlbasic function of the '/goform/formWlbasic' endpoint. Command injection is a flaw that allows a...
PT-2026-73178
A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...
SUSE CVE-2026-74511
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
[slackware-security] proftpd
New proftpd packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/proftpd-1.3.9d-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues, including: Addressed possible use-after-fre...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055
shescape , a Node.js shell-escape library, is vulnerable to improper tilde (~) escaping in assignment contexts when the Unix shell is configured to "sh" or true and /bin/sh points to BusyBox. The root cause lies in the getEscapeFunction logic in src/internal/unix/busybox.js: untrusted input such ...
Malicious code in depcruise-baseline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...
Malicious code in harmony-app-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...
MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...
Malicious code in require-i18next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...
MAL-2026-14052 Malicious code in require-i18next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...
AZL-96237 CVE-2026-74510 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...
CVE-2026-74510
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...
AZL-96111 CVE-2026-74458 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...
CVE-2026-74458
In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...
CVE-2026-74443
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...
AZL-96336 CVE-2026-74443 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...
CVE-2026-74444
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...
UBUNTU-CVE-2026-74510
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMTOPPAIRDEVICE command by walking hdev-mgmtpending. The lookup returned a command that was...