CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

EUVD-2026-67166

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

CVE-2026-76640: Out-of-bounds Write

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

EUVD-2026-66248

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81939

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58095: Heap-based Buffer Overflow

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a...

CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a...

CVE-2026-80185

BlueZ 5.86 contains a type confusion vulnerability in its sdp-xml.c parser. A crafted nested ServiceRecord passed via RegisterProfile corrupts the SDP XML parser stack, causing scalar union data to be misinterpreted as a sequence pointer. This allows an unprivileged local caller or an adjacent LE...

CVE-2026-80185 Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

Linux Distros Unpatched Vulnerability : CVE-2026-66897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, ...

CVE-2026-61898

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...

CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

MiracleLinux 9 : dracut-057-120.git20260728.el9_8 (AXSA:2026-1634:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1634:06 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the...

CVE-2026-66897: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...