EUVD-2026-46277

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions...

CVE-2026-56585 HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions...

CVE-2026-56585

The documents describe an Anti-Clickjacking X-Frame-Options header missing in HCL IEM, but no public technical details (affected versions, vectors, or fixes) are provided here. Monitor for updates.

CVE-2026-16445

CVE-2026-16445 affects dracut’s NetworkManager-based initrd network module. A remote attacker on the adjacent network can craft DHCP options (root-path/next-server/bootfile) that are written into a temporary shell script without proper escaping, enabling command injection and root code execution ...

CVE-2026-16445 Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

EUVD-2026-46253

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

EUVD-2026-46118

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

libvirt security update

11.10.0-12.4.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 11.10.0-12.4.el102 - cpuconf: Introduce virCPUDefSortFeatures RHEL-180449 - qemucapabilities: Split virQEMUCapsFillDomainCPUCaps RHEL-180449 - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel...

unbound security update

1.24.2-15 - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance 1.24.2-14 - Fix CVE-2026-41292: DoS via excessive EDNS options 1.24.2-13 - Add upstream unit test for CVE-2026-40622 1.24.2-12 - Fix CVE-2026-44390: DoS with large RRsets 1.24.2-11 - Fix CVE-2026-40622: cache...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

GHSA-7Q8Q-RJ6J-MHJQ Axios: Nested axios option objects can consume polluted prototype values

Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinar...

CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

CVE-2026-64624 affects FreeRDP prior to 3.28.0. The issue arises because lines starting with a forward slash in RDP files are treated as raw command-line options, exposing the CLI parser surface to untrusted files. This enables attackers to craft malicious RDP files leveraging options such as /rd...

CVE-2026-56624 Apache MINA SSHD: SSH certificate options lack validations

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

CVE-2026-35217

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

CVE-2026-35217

CVE-2026-35217 affects NanoMQ (MQTT v5) where a SUBSCRIBE packet can be processed even when the final 1-byte Subscription Options field is missing. A specific packet-length construction reveals two manifestations of a single parsing defect: (1) the broker may accept the malformed subscription and...

PT-2026-61602

Name of the Vulnerable Software and Affected Versions Menyoo 2.0 versions prior to commit 729aa48 Description A directory traversal issue allows a local attacker to execute arbitrary code. This occurs through the Spooner file management, the save, folder, and rename functions of the VehicleSpawne...

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality,...

CVE-2026-52349

CVE-2026-52349 : Directory traversal vulnerability in Menyoo 2.0 (pre-commit 729aa48). A local attacker could exploit Spooner file management, VehicleSpawner, WeaponOptions, and PedComponentChanger operations to achieve arbitrary code execution. Root cause is path handling in save/folder/rename/c...