Rocky Linux 9 [CIQ] Security Update: tuned / tuned-gtk / tuned-ppd / tuned-profiles-atomic / etc Multiple Vulnerabilities (crlsa-2024_10384)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410384 advisory. tuned: scriptpre and scriptpost options allow to pass arbitrary scripts executed by root CVE-2024-52336 tuned: improper sanitization of instancename...

Rocky Linux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786542017)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786542017 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786542017)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786542017 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787064068)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787064068 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

CVE-2026-100714

Froxlor versions up to and including 2.3.10 are vulnerable to command injection due to the lack of restriction or escaping on the system.letsencryptchallengepath setting. The application unescaped concatenates this value into the acme.sh command line within lib/Froxlor/Cron/Http/LetsEncrypt/AcmeS...

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-93425

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

EUVD-2026-86253

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

DEBIAN-CVE-2026-83603

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

CVE-2026-83603

The open source observability tool Netdata contains a privilege escalation vulnerability in the setuid-root ndsudo helper command (fail2ban-client-status-socket) located in src/collectors/utils/ndsudo.c. A low-privileged netdata service account can provide a caller-controlled --socket_path to dir...

CVE-2026-80152

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

CVE-2026-80145

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root ...

CVE-2026-80152

Lantronix SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), and SLB882/SLCx-03/SLCx-02 (all firmware versions) contain an OS command injection in the set script schedule command, which passes unsanitized user input to a system() call. An authenticated attacker with the servic...

CVE-2026-80152 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

EUVD-2026-84517

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by...

CVE-2026-80145 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root ...

CVE-2026-80144 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented...