CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...

CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...

CVE-2026-116673

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...

CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...

CVE-2026-116673

The systeminformation library for Node.js (versions prior to 5.33.14 ) contains a path traversal vulnerability in the Linux networkStats(iface) implementation. The issue occurs because the library fails to verify that the caller-supplied iface value is a single segment or remains under the /sys/c...

CVE-2026-105477

A vulnerability in Veeam Agent for Linux enables local privilege escalation . This issue specifically affects installations that are managed by a Veeam Backup & Replication instance. The root cause is associated with an Untrusted Search Path (CWE-426). No specific exploit information or remediati...

CVE-2026-105477

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected...

EUVD-2026-111125

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected...

Important: Red Hat Security Advisory: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Microsoft Issues Emergency .NET Fixes for Brotli Flaw and Linux Privilege Escalation

Microsoft releases emergency .NET updates to fix a Brotli memory flaw and Linux privilege escalation, while correcting two incomplete October security patches...

Important: Red Hat Security Advisory: brotli security, bug fix, and enhancement update

An update for brotli is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: brotli security, bug fix, and enhancement update

An update for brotli is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-92372

The TeamViewer Full Client for Linux and macOS (versions prior to 15.83) contains an out-of-bounds write vulnerability in its screen-image decoder . The root cause is missing destination bounds checking, which allows a remote attacker to execute arbitrary code by supplying crafted screen-image da...

Exploit for CVE-2026-114148

CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalatio...

Important: Red Hat Security Advisory: brotli security, bug fix, and enhancement update

An update for brotli is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

MultiTech Conduit import_config filename command injection RCE

Authenticated POST /api/command/uploadconfig with malicious filename breaks out of importconfig shell quoting. """MultiTech Conduit AEP importconfig filename command injection root RCE.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

AOMEI Cyber Backup Thrift NAS mount injection RCE

AddBackupStorageNAS + DeleteBackupStorage: NAS username quote-break into CNasHelper mount system ports 9074/9078. """AOMEI Cyber Backup Unauthenticated Thrift NAS Mount Injection RCE""" from future import annotations from kittysploit import import os import socket import struct import sys import...

CacheGuard config import eval injection RCE

Admin login and multipart upload to /gui/conf-load-save.apl injects $cmd into config; transaction commit eval executes as admin. !/usr/bin/env python3 -- coding: utf-8 -- """CacheGuard authenticated config import eval injection RCE.""" from future import annotations import re from urllib.parse...

Syncrify PublicLink chunk upload traversal cron root RCE

Backup user PublicLink auth then binary chunk upload st=u with traversing chunk name writes /etc/cron.d/. """Syncrify PublicLink chunk upload path traversal cron root RCE.""" from future import annotations import re import struct import time from urllib.parse import quote from kittysploit import...

Wyn Enterprise unauthenticated token forgery provider load root RCE

Forged integration JWT → admin reference token → admin/api/import Zip-Slip EvilProvider.dll → security-providers reload. """Wyn Enterprise token forgery import Zip-Slip EvilProvider load root RCE.""" from future import annotations import base64 import io import json import re import zipfile from...