SUSE CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

PT-2026-84417

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Local privilege-escalation flaws allow a local attacker to execute arbitrary code with root privileges on the underlying operating system of the affected system...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

Alibaba Cloud Linux 3 : 0280: dracut (ALINUX3-SA-2026:0280)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0280 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-15816: A flaw was found in dracut. The die...

CVE-2026-59681: Improper Neutralization of Special Elements used in an OS Command

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-16658

A flaw was found in the community.proxmox Ansible collection's proxmoxpctremote connection plugin. The buildpctcommand method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command such a...

SUSE CVE-2026-59681

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

PT-2026-84137

Name of the Vulnerable Software and Affected Versions yast2-auth-client affected versions not specified Description An OS command injection flaw exists in the Auth::AuthConf function within src/lib/auth/authconf.rb. The issue occurs when the software assembles Samba net ads join, net ads lookup -...

PT-2026-84136

Name of the Vulnerable Software and Affected Versions yast2-samba-client versions prior to 5.0.5 Description Improper neutralization of special elements used in an OS command allows an attacker to execute arbitrary commands as root on a machine being joined to a domain. This occurs when the...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3875 (ALAS-2026-3875)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3875 advisory. A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hoo...

OESA-2026-3501 dracut security update

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...

EUVD-2026-67855

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

EUVD-2026-67303

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability scored CVSS 8.8 (HIGH) . An attacker on an adjacent network can chain three weaknesses—an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissio...

CVE-2026-76639 Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-74233

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain...

EUVD-2026-67000

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain...