EUVD-2026-104392

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an expression injection flaw. The root cause is that AdhocQueryValidator.validate() fails to inspect sub-query expression maps within the orQueries field of TaskQueryDto . This allows authenticated users to bypass ...

CVE-2026-109432

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

Exploit for CVE-2026-105105

CVE-2026-105105: NASA-AMMOS AIT-Core Unauthenticated ZeroMQ Co...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

The Television (tv) application, versions 0.15.0 through 0.15.9 , is vulnerable to OS command injection due to improperly escaped single quotes in the format_command function. An attacker can exploit this by planting a file with a crafted name containing an apostrophe; subsequently, triggering an...

EUVD-2026-104310

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-98509

A flaw was found in the Linux kernel's virtio graphics processing unit virtio-gpu driver. A local user can cause a Denial of Service DoS by triggering a kernel memory leak during graphics command buffer processing. When invalid submission parameters are provided, the driver's error-handling path...

CLSA-2026-1792399515 Fix CVE(s): CVE-2026-106553, CVE-2026-106555, CVE-2026-106583, CVE-2026-106585

SECURITY UPDATE: GSSAPI client state and credentials persisted across authentication attempts - debian/patches/CVE-2026-106553-CVE-2026-106555.patch: add sshgssapicleanupglobalclient and call it before each userauth request in auth2.c and before each pre-auth GSSAPI context setup in monitor.c, an...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400: Vulnerability Analysis, Patch Management, Cyber...

CVE-2026-76740

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

Astra Linux – vulnerability in python-click

This CVE record was assigned without adhering to CNA/CVE guidelines, and it is not regarded as a valid vulnerability by the Pallets Click project. The original CVE record description is retained below: Pallets Click versions 8.3.2 and earlier contain a command injection vulnerability in the...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: serialize sequence allocation under concurrent TLB invalidations With concurrent TLB invalidations, completion wait randomly gets timed out because cmdsemval was incremented outside the IOMMU spinlock, allowing...

Astra Linux – vulnerability in libhttp-daemon-perl

HTTP::Daemon versions prior to 6.17 for Perl allow OS command injection via sendfile. sendfile opens its string argument using Perl’s two-argument open mechanism. The two-argument form interprets special prefixes: ‘| cmd’ and ‘cmd |’ open a pipe to a subprocess; ‘ path’ and ‘ path’ open the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: drop redundant sched job cleanup when cs is aborted Once command submission fails due to invalidation of userptr in amdgpucssubmit, legacy code attempts to clean up scheduler jobs. However, this cleanup is unnecessary...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

Astra Linux – vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method. This method constructs shell commands by interpolating user-supplied Perforce connection parameters—such as port, user,...