Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: This issue prevents UAF Use-after-Allocation Fault caused by a race condition involving non-leader exec. Wongi and Jungwoo identified and reported a race condition related to exec, which can lead to UAF. The...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

PT-2026-84885

A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell exec of the file crates/openfang-runtime/src/tool runner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to be carried out remotely. The exploit ha...

CVE-2026-10195

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

EUVD-2026-69300

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the libvirt discovery process when enablelibvirt is set to true. An attacker can execute arbitra...

CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-10195: Improper Neutralization of Special Elements used in a Command

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

PT-2026-84294

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

The vulnerability of the strtol() function in the su-exec utility allows a attacker to elevate their privileges to root and execute arbitrary code.

The vulnerability of the strtol function in the su-exec utility is related to incorrect conversion of numerical types. Exploiting this vulnerability can allow an attacker to elevate their privileges to root and execute arbitrary code...

CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

CVE-2026-83524

A command injection vulnerability affects the System Clock component of RedPort Optimizer wXa-203 , wXa-213 , and wXa-223 (up to version 20260704). The flaw resides in the exec function of /xgatev1/system/datetime.php, allowing a remote attacker with low privileges to inject commands without user...

CVE-2026-80713

A flaw was found in the Linux kernel's iouring subsystem. When a task that has used iouring performs an exec call, its per-task restrictions are not properly preserved. This oversight allows a subsequent iouring ring created by the task to operate without the intended security restrictions,...

Linux Distros Unpatched Vulnerability : CVE-2026-80713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across...