CVE-2026-62948

OpenWrt odhcpd/LuCI vulnerability CVE-2026-62948: Before 25.12.5, the DHCPv6 client FQDN option 39 hostname is written into /tmp/odhcpd.leases without escaping, allowing newline injection of forged lease lines. LuCI displays these lines in the Active DHCPv6 Leases page via rpcd-mod-luci getDHCPLe...

Digital-Archiving-Solutions-v1.02-RCE

LPD Shell Injection — RCE Exploit RFC 1179 A precision Pyth...

SUSE-SU-2026:3055-1 Security update for radvd

This update for radvd fixes the following issue - CVE-2026-48715: stack-based buffer overflow in the radvdump Route Information option parser when processing crafted ICMPv6 Router Advertisements bsc1268641...

USN-8547-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Network drivers; -...

RHEL 10 : yggdrasil (RHSA-2026:39573)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39573 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate chil...

MAL-2026-10644 Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

Malicious code in proxy-check-ii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a736498f3f882a4ba79f793dc893883db41d8cb5a74ecfe0c66dace9cc477a20 The wheel is advertised as 'proxy-check-ii' with a one-line summary of 'packaged command for running the bundled qsshd executable' and no README,...

Digital-Archiving-Solutions-RCE-PoC

LPD Server — Shell Injection Exploit RFC 1179 Disclaimer...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.

The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to the handling of pointers. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.

The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to the handling of pointers. Exploiting this vulnerability could allow a malicious actor to cause service failures...

ALSA-2026:39573 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: net: golang: Go net package: Denial of Service vi...

Buffer overread in authd and wad daemon

...

openSUSE 16: libipa_hbac-devel / libipa_hbac0 / libnfsidmap-sss / etc (openSUSE-SU-2026:21290-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21290-1 advisory. This update for sssd fixes the following issues - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by...

The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.

The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Malicious code in claude-team-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e9f6179a67a2904c37bd9cff22174a8c57755972fc878047993c35c03f5544 On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached...

CVE-2026-15548

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely...

Vulnerabilities found in Juniper Networks’ Junos OS and Junos OS Evolved

Juniper has identified several vulnerabilities in Junos OS and Junos OS Evolved, specifically related to devices in the MX Series, PTX Series, QFX Series, EX Series, SRX Series, and QFX10000 Series. These vulnerabilities affect various components of Junos OS and Junos OS Evolved, including the...

MAL-2026-10216 Malicious code in node-sysmetrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e624a951ebd9352b2b8d47bf80d418a01674640ec2d2b2592f00bb446f110c68 On npm install, install.js executes as a postinstall script and drops a detached background Node process at /tmp/.sysm-agent.js that persists after...

The vulnerability of the server daemon incusd in the container management system and the Incus virtual machine manager allows a hacker to trigger a service failure.

The vulnerability of the server daemon incus in the container management system and the Incus Virtual Machine Manager is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...