Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21802 info: name: Advantech R-SeeNet - Cross-Site Scripting author:...

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the telnetform.php script functionality. id: CVE-2021-21799 info: name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting author: arafatansari severity: medium description: | Advantech R-SeeNet 2.4.12 contains a...

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the sshform.php script functionality. id: CVE-2021-21800 info: name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting author: arafatansari severity: medium description: | Advantech R-SeeNet 2.4.12 contains a...

APsystems ECU-R Firmware - Command Injection

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. id: CVE-2022-45699 info: name: APsystems ECU-R Firmware - Command Injection author: pussycat0x severity:...

Advantech R-SeeNet 2.4.12 - OS Command Injection

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering...

CLEANSTART-2026-SK95653 Security fixes in kapp-controller 0.57.0-r0

Package kapp-controller version 0.57.0-r0 fixes 6 vulnerabilities: ghsa-hfvc-g4fc-pqhx, ghsa-p77j-4mvh-x3m3, ghsa-mh2q-q3fh-2475, CVE-2026-33186, CVE-2026-39883...

CLEANSTART-2026-BI40968 Security fixes in grafana-rollout-operator 0.35.0-r0

Package grafana-rollout-operator version 0.35.0-r0 fixes 7 vulnerabilities: CVE-2026-25679, ghsa-p77j-4mvh-x3m3, CVE-2026-27138, CVE-2026-27137, CVE-2026-27142...

CLEANSTART-2026-ZJ55365 Security fixes in ip-masq-agent 2.12.6-r1

Package ip-masq-agent version 2.12.6-r1 fixes 24 vulnerabilities: CVE-2025-61726, CVE-2026-25679, CVE-2025-61729, CVE-2025-68121, CVE-2025-68119...

B&R Automation X20EDS410 Out-of-bounds Write (CVE-2026-46300)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's skbtrycoalesce that loses the shared-frag marker during coalescing. Successful local exploitation of this vulnerability could allow an authenticated attacker with low...

MINI-68HV-GH7R-XP8W

Bulletin has no description...

CVE-2026-50103

CVE-2026-50103 affects the GOOSE/R-GOOSE parser in libIEC61850 (MZ Automation) and describes a NULL dereference when parsing malformed TLV values, enabling a network-adjacent DoS by crashing the subscriber. The related PoCs and analysis in the connected documents confirm the issue and indicate fi...

CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

MINI-JHCX-7R22-5CP6

Bulletin has no description...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

SUSE CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

CVE-2026-63886 scsi: target: iscsi: Validate CHAP_R length before base64 decode

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

EUVD-2026-45771

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

CVE-2026-63886

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAPR length before base64 decode chapservercomputehash allocates clientdigest as kzallocchap-digestsize and then, for BASE64-encoded responses, passes chapr directly to chapbase64decode without...

MINI-43R2-M8HW-XPXF

Bulletin has no description...

2026-07 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 (KB5102205)

2026-07 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 KB5102205...