CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1777627629)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777627629 advisory. - In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario wher...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1780076591)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1780076591 advisory. - An issue was discovered in writetptentry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver ...

SUSE CVE-2026-97951

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target core sets CMDTABORTED and waits for the frontend to finish processing. ...

SUSE CVE-2026-97983

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794

The Ziroom ZHOME A0101 1.0.1.0 is vulnerable to a command injection flaw due to improper processing of the url argument within the /api/ZRnetwork/ping file. This vulnerability allows for remote attack execution. While the exploit has been disclosed to the public and may be used, the vendor has no...

CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon Exploit バージョン 25.0.1 GibbonEdu Gibbon バージョン 25.0.1 以前 GibbonEdu Gibbon バージョン 25.0.1 以前では、任意のファイル書き込みが可能です。 詳細情報 https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ 免責事項...

nextjs-CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 React2Shell - Next.js リモートコード実行 RCE PoC Next.js Server Actions における深刻な脆弱性。React Flight Protocol のデシリアライズを介した認証不要のリモートコード実行が可能 概要 このリポジトリは、Server Actions（React Server Functions）を使用する Next.js アプリケーションに影響する深刻なRCE脆弱性の Proof of Concept PoC を含んでいます。 詳細| 情報 ---|--- CVE|...

CVE-2026-103040

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-102792

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-102793

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_time_zone function within the /api/ZRFirmware/set_time_zone file. An attacker can achieve remote command execution by manipulating the hostname/zonename argument. The documents indicate...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

GHSA-2GX3-RCP4-G85Q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

MAL-2026-17296 Malicious code in test-agency-assignment-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2098eadf99f0ffe4dc04f478ed085034d30415cb52201be4f36f688298abc46e The tarball contains only package.json and an 8.4 MB Go-compiled Windows executable, Kelimasow.exe sha256...

Malicious code in test-agency-assignment-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2098eadf99f0ffe4dc04f478ed085034d30415cb52201be4f36f688298abc46e The tarball contains only package.json and an 8.4 MB Go-compiled Windows executable, Kelimasow.exe sha256...

Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

MAL-2026-17295 Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...