CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

EUVD-2026-67360

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

PT-2026-83256

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

PT-2026-83273

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

EUVD-2026-67767

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83053

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An unauthenticated attacker can cause a denial of service for Sieve script management by sending a small malformed command before authentication, which crashes the ManageSieve login process. The...

PT-2026-83057

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can craft a message header that causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the...

UBUNTU-CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

openSUSE 16 Security Update : v2ray-core (openSUSE-SU-2026:21653-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21653-1 advisory. Changes in v2ray-core: - Update version to 5.53.0 Add X-Forwarded-For support to gRPC transport Add Stream based Packet Addr for UDP Connections...

PT-2026-82941

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

PT-2026-83334

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description An authenticated attacker can execute arbitrary operating system commands within the server process. This occurs by saving a flow containing a crafted value in the type field and...

TagZilla: Automated Owner and Abuse Type Tagging for Indicators of Compromise in Threat Reports

Cyber Threat Intelligence CTI reports often describe Indicators of Compromise IoCs such as IP addresses, URLs, file hashes, and cryptocurrency wallets involved in cyberattacks. Those IoCs are typically described in the unstructured report's text, or listed at the end of the report with little...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

PT-2026-83052

This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mail max userip connections is reached bsc1276794. - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing afte...

PT-2026-82868

Name of the Vulnerable Software and Affected Versions NUMail versions prior to 202602162 Description NUMail contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating-system commands on the server. This occurs because the applicati...

UBUNTU-CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: storm (UTSA-2026-093009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093009 advisory. A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially...

UBUNTU-CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...