308142 matches found
PT-2026-73434
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...
Important: perl-Net-DNS
Issue Overview: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval...
PT-2026-73202
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl nas sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be...
PT-2026-76790
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...
PT-2026-76817
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description A sandbox breakout allows code running within the environment to escape and execute arbitrary commands on the host system. The issue occurs because lib/bridge.js and lib/setup-sandbox.js fail to block...
PT-2026-76893
Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...
PT-2026-73432
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
ROS-20260817-73-0218
The vulnerability of the command-line tool openssl dgst from the OpenSSL library is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker to influence the integrity of the protected information...
PT-2026-73195
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub 44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploi...
PT-2026-76658
Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with local access could exploit this flaw to achiev...
PT-2026-76722
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description The REST API server contains a flaw in its safety check designed to prevent the combination of cors credentials=True and an unrestricted CORS origin allowlist. The check in glances/outputs/glances...
PT-2026-76721
Name of the Vulnerable Software and Affected Versions Glances versions 4.5.2 through 4.5.5 Description An issue exists where the sanitize mustache dict function in glances/actions.py only sanitizes top-level string values, skipping nested lists and dictionaries. This allows shell operators,...
EUVD-2026-60535
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099752)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099752 advisory. In the Linux kernel, the following vulnerability has been resolved: comedi: Reinit dev-spinlock between attachments to low-level drivers struct comedidevice is the...
RHEL 8 : 389-ds:1.4 (RHSA-2026:55530)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55530 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...
RHEL 9 : 389-ds-base (RHSA-2026:55422)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55422 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...
RHEL 8 : pcp (RHSA-2026:55560)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55560 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100128)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100128 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-100895)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100895 advisory. A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from W...
RHEL 9 : 389-ds-base (RHSA-2026:55423)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55423 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...