kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

CVE-2026-65139

NVIDIA Slurm is vulnerable to an attacker-controlled SQL injection attack within certain SlurmDBD RPCs . This vulnerability could potentially lead to arbitrary code execution . The issue was addressed in the Debian stable distribution (trixie) with version 24.11.5-4+deb13u1 . Exploitation details...

CVE-2026-65139

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

EUVD-2026-116013

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-121578

Tactical RMM is susceptible to a stored XSS vulnerability due to improperly validated input or encoded output across various fields. This allows an attacker to inject and store malicious HTML/JavaScript within the tools database . When users view content containing these infected objects, the scr...

CVE-2026-121578 CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

EUVD-2026-116009

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

CVE-2026-121578 CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

Security update for rsyslog

This update for rsyslog fixes the following issues: CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution bsc1286926. RainerScript replace length wrap bsc1285036...

SUSE-SU-2026:5089-1 Security update for rsyslog

This update for rsyslog fixes the following issues: - CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution bsc1286926. - RainerScript replace length wrap bsc1285036...

CVE-2026-121428

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

EUVD-2026-115908

Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...

CVE-2026-121451

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121451

AB Download Manager versions prior to 1.11.2 are vulnerable to a cross-site request forgery (CSRF) vulnerability within its unauthenticated browser-integration API. An attacker can exploit this by tricking a user into visiting a malicious webpage that sends a text/plain request to the /start-head...

EUVD-2026-115883

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

Important: Red Hat Security Advisory: raptor2 security update

An update for raptor2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling

A flaw was found in raptor2. The library improperly handles language tag lengths when parsing RDF Resource Description Framework documents, truncating lengths that exceed 255 bytes. A remote attacker can exploit this vulnerability by supplying a specially crafted document with an overly long...

kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855, also known as Proxylogon, is a server-side request forgery SSRF vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server. According to Orange Tsai, the researcher who discovered the vulnerabilities,...

CVE-2026-121429 AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...