EUVD-2026-63797

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

EUVD-2026-63792

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

CVE-2026-76157

Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...

CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function

Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...

CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-76156

Datiphy Data Management Center v8.3.0 through v8.5.1 has an OS command injection flaw (CWE-78) in its API endpoint, allowing authenticated administrators to execute arbitrary OS commands as root. No patch version or workaround is mentioned in the provided documents. Exploitation details are not p...

EUVD-2026-63794

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)

Summary DS8900F and DS8A00 updates have been released to remediate vulnerabilities in various components like IBM Java Quarterly Update, IBM WebSphere Application Server, IBM Power HMC, Linux Kernel, OpenSSL, libsoup, libssh, OpenSSH, net-snmp, Apache HTTP Server httpd, Expat libexpat, libpng,...

CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

SUSE CVE-2026-65610

nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...

SUSE CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

SUSE CVE-2026-68245

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

SUSE CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

SUSE CVE-2026-72185

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

SUSE CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...