270190 matches found
RHEL 10 : freerdp (RHSA-2026:54486)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54486 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...
CVE-2026-49481
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49819
UpSnap (wake on LAN web app) versions 4.4.1–5.3.5 are vulnerable to an unauthenticated privilege-escalation chain in pb.HandlerInitSuperuser (backend/pb/handlers.go:249). The vulnerability is reachable via POST /api/upsnap/init-superuser and is gated only by a totalSuperusers > 0 check, with n...
CVE-2026-49819
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...
CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...
EUVD-2026-57697
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...
CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...
CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49481
UpSnap (wake on LAN web app) before version 5.4.0 is affected by an authenticated OS command injection in device management. User-controlled ip/mac values can be interpolated into wake_cmd/shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, enablin...
CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-73429
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:12+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-g9hv-x236-4qp3...
CVE-2026-73519
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...
CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...
CVE-2026-71471
The CVE-2026-71471 issue affects acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster who has patch access to the Search Custom Resource can exploit the Collector.ImageOverride field to deploy an arbitrary container image across all managed clusters, enabling remote ...
CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...
CVE-2026-71471
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...
CVE-2026-13433
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...
CVE-2026-73519
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...
CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...
CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...