Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005586 advisory. Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's,...

The vulnerability of the d6_dhcpc.c component in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure

The vulnerability in the d6dhcpc.c component of the UNIX command-line utilities in BusyBox relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21663-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21663-1 advisory. Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to...

KLA91246 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

Security update for wicked (important)

openSUSE security update: security update for wicked ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21669-1 Rating: important References: bsc1274627 Cross-References: CVE-2026-71401 CVE-2026-71402 CVSS scores: CVE-2026-71401 SUSE : 7.5...

Security update for wget (important)

openSUSE security update: security update for wget ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21665-1 Rating: important References: bsc1271033 bsc1271034 bsc1271035 bsc1271036 bsc1271320 bsc1272219 bsc1273449 Cross-References: CVE-2026-15146...

Security update for gzip (moderate)

openSUSE security update: security update for gzip ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21666-1 Rating: moderate References: bsc1269623 bsc1272554 Cross-References: CVE-2026-41992 CVSS scores: CVE-2026-41992 SUSE : 6.1...

ProFTPd 1.3.9 mod_sql SQL Injection / Remote Code Execution

ProFTPD versions prior to 1.3.9a contain an SQL injection vulnerability in the modsql module due to improper handling of attacker-controlled values considered already escaped. This exploit uses an authenticated FTP STOR filename to inject a stacked PostgreSQL query and execute an arbitrary...

...[ More ]

This Metasploit module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. T...

PT-2026-83267

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web vlan membership edit dialog post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

PT-2026-83311

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio auth and api auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-83127

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows remote attackers to execute arbitrary commands via a crafted input. The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector requiring no privi...

UBUNTU-CVE-2026-33605

An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode default for community releases, only the attacker's own connection is terminated. If running in high-performance mode default for Pro...

UBUNTU-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

PT-2026-83240

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr checker.yml places github.head ref and github.event.pull request.head.repo.full name into BRANCH NAME and SOURCE REPO and interpolates those untrusted...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

PT-2026-83012

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET FEATURE qcom spi send cmdaddr programs NAND FLASH CMD/NAND EXEC CMD and submits the descriptors, which makes the controller execute the command immediately. For...

PT-2026-82834

In openNDS before 11.0.0, the client params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...