PT-2026-81381

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and...

PT-2026-81521

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...

PT-2026-82001

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

PT-2026-81515

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

PT-2026-81351

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS command injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist defined in security.yaml. However, the defaul...

PT-2026-81902

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection include and md clean include re-parse the content of an included Markdown file as Jinja2 template...

PT-2026-81226

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a hacker to induce a service failure.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver exposes confidential or sensitive information in error messages from the command shell. Exploiting this vulnerability could allow an attacker t...

PT-2026-81146

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

RHEL 9 : golang (RHSA-2026:57649)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57649 advisory. The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via...

RHEL 9 : sg3_utils (RHSA-2026:59397)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59397 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

EulerOS Virtualization 2.13.1 : curl (EulerOS-SA-2026-3169)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a...

RHEL 8 : sg3_utils (RHSA-2026:59568)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59568 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 152.0.7977.64 Linux 152.0.7977.64/.65 Windows/Mac contains a number of fixes and improvements -- a list of changes is...

EulerOS Virtualization 2.13.1 : httpd (EulerOS-SA-2026-3175)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.This issue affects Apache HTTP Server: through...

CVE-2026-23918-Passive-Audit

Script de auditoria CVE-2026-23918 alternativamente, você poderia apenas usar curl nos cabeçalhos e dar uma olhada, mas aqui está: Auditor de metadados HTTP não invasivo para Apache HTTP Server Triagem de exposição CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19. A...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...

CVE-2014-6287

Rejetto HttpFileServer 2.3.x - Remote-Befehlsausführung CVE-2014-6287 🚨 Über den Exploit Dies ist ein Proof-of-Concept-Exploit für die bekannte Remote-Befehlsausführungsschwachstelle in Rejetto HttpFileServer HFS v2.3.x , identifiziert als CVE-2014-6287. Durch Missbrauch der anfälligen Suchfunkti...

Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.45 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...