CVE-2026-72538 PrefectHQ Prefect - Argument Injection

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...

CVE-2026-72538 PrefectHQ Prefect - Argument Injection

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...

EUVD-2026-56008

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...

EUVD-2026-56002

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13738 Improper Authorization Validation

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13738

CVE-2026-13738 describes an authorization bypass in CommServe that affects a limited set of command execution operations. The vulnerability impacts a broad set of Commvault components (Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X) and is characterized by a high-sev...

CVE-2026-13738

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13738 Improper Authorization Validation

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13737 Command Restriction Bypass

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13739 Server-Side Request Forgery (SSRF)

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

CVE-2026-13739

The CVE-2026-13739 vulnerability affects a legacy Command Center endpoint, described as an unauthenticated Server-Side Request Forgery (SSRF) involving handling of arbitrary target URLs. The issue permits external control over requests initiated from the vulnerable system, with potential impact t...

CVE-2026-13737

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13739

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

CVE-2026-13737

The CVE-2026-13737 issue affects Commvault software (Commserve, Webserver, Command Center, Media Agents, Clients, HyperScale X) and is a command execution authorization allowlist bypass. Root cause: bypass of allowlists permits commands to run without proper authorization. Impact stated in the me...

CVE-2026-13737 Command Restriction Bypass

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

EUVD-2026-56000

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

EUVD-2026-56001

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

Security update for libpng16

This update for libpng16 fixes the following issues: Changes for libpng16: version update to 1.6.58 jscPED-16190. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed fo...

Security Bulletin:Vulnerability in Vim affects IBM Netezza Appliance

Summary The Vim package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2022-2889, CVE-2026-46483 Vulnerability Details CVEID:CVE-2026-46483 DESCRIPTION: Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerabili...

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month,...