Astra Linux – Vulnerability in udisks2

A flaw was discovered in udisks2. A local attacker with an active console session can exploit insufficient authorization checking for the “as-user” option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to forge the “as-user” parameter, mounting file systems...

SUSE CVE-2026-74355

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info-node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the devicerbtreeinsert call is skipped. If a subsequent probe step fails, the...

PT-2026-85260

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is...

PT-2026-85261

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback url/sync interval results in os command injection. The attack can be initiat...

PT-2026-85265

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit h...

The vulnerability of the sub_41802C() function in the /boafrm/formLtefotaUpgradeFibocom file of the LTE Module Firmware Upgrade component of the D-Link DIR-825M router’s microprogramming system allows a intruder to execute arbitrary code.

The vulnerability of the sub41802C function in the /boafrm/formLtefotaUpgradeFibocom file of the LTE Module Firmware Upgrade component of the D-Link DIR-825M router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability coul...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105539 advisory. A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter...

CVE-2026-85222: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

The vulnerability of the sub_46725C() function in the /boafrm/formDiskFormat file of the Disk Formatting Handler Endpoint component of the D-Link DIR-825M microprogramming device, which allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the sub46725C function in the /boafrm/formDiskFormat file of the Disk Formatting Handler Endpoint component of the D-Link DIR-825M microprogramming router lies in the fact that the output of the operation is stored outside of the buffer in memory. Exploiting this vulnerabilit...

CVE-2026-85223: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85224: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

The vulnerability of the sub_42EF14() function in D-Link DCS-932L microprogrammed camera software allows a intruder to execute arbitrary commands.

The vulnerability of the sub42EF14 function /bin/alphapd of the D-Link DCS-932L microprogrammed surveillance camera is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the sub_424D20() function in D-link DIR-823X router microprogramming software allows a hacker to execute any command they desire.

The vulnerability of the sub424D20 function /goform/setipv6 of the D-link DIR-823X router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability in the script cgi/backup_mgr/iscsi_mgr.cgi of the D-Link DNS-345 and DNS-340L network storage software allows a perpetrator to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability in the cgi/backupmgr/iscsimgr.cgi script of the D-Link DNS-345 and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gai...

The vulnerability in the cgi/disk_mgr/ve_mgr.cgi script of the D-Link DNS-327L and DNS-340L network storage software allows a perpetrator to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability in the cgi/diskmgr/vemgr.cgi script of the D-Link DNS-327L and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gain...

Exploit for CVE-2026-82592

D-Link Router DIR-825M - Buffer Overflow in /boafrm/formDiskFo...

SUSE CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

openSUSE 16: libudisks2-0 / libudisks2-0-devel / libudisks2-0_btrfs / etc (openSUSE-SU-2026:21704-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21704-1 advisory. This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the...

Oracle Linux 8 : ELSA-2026-61766-0: / glib2 (ELSA-2026-617660)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-617660 advisory. - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58011: rang...

Alibaba Cloud Linux 3 : 0262: abrt (ALINUX3-SA-2026:0262)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0262 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54228: A time-of-check time-of-us...