Security update for open-iscsi

This update for open-iscsi fixes the following issues: CVE-2026-44943: remote file-write as root via discovery bsc1268353. CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

PT-2026-78447

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description Authenticated attackers can execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync command binary forwards this inp...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

EUVD-2026-58802

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...

CVE-2026-19908

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The...

CVE-2026-19908

CVE-2026-19908 affects the PAX Technology Q80 XCB Daemon. The flaw arises from a lack of authentication before accessing daemon functionality, allowing network-adjacent attackers to disclose sensitive information and modify configurations. The description also notes potential to execute arbitrary...

CVE-2026-19909

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-19909

Technical details beyond the initial description are not publicly available in the provided connected documents. No concrete information on affected products/versions, root cause specifics, impact scope, or remediation is present. Monitor for updates.

CVE-2026-19909 PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...

RLSA-2026:54576 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CVE-2026-67613

CyberPanel

VulnCheck KEV: CVE-2025-55583

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a preapiarg parameter that is passed directly to system-level shell execution functions without...

Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CVE-2026-73519

WolfStack before version 25.9.2 contains a hard-coded cluster-authentication secret compiled into builds (src/auth/mod.rs). Attackers can bypass require_auth() by sending the secret in the X-WolfStack-Secret header, without a session, API key, or user account. From a management port, an attacker ...

CVE-2026-19656

CVE-2026-19656 affects ScadaLTS 2.7.8.1, where a server-side method lacks authorization checks. Any authenticated user (even with low-privilege, read-only rights) can execute arbitrary operating system commands on the host, yielding code execution in the ScadaLTS server process (root) and full sy...

Security update for dracut

This update for dracut fixes the following issue: Update to version 055+suse.367.g85633e8. Securitys issue fixed: CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: Fixbase: sanitize message writt...

CVE-2026-66150

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP...

EUVD-2026-56947

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP...

CVE-2026-66149

CVE-2026-66149 affects SonicWall Email Security appliances. An authenticated user with access to the restricted CLI can exploit a code-injection weakness to run arbitrary OS commands as root via netmask, via a local attack vector. The combined CVSS 3.1 metrics indicate high impact to confidential...

EUVD-2026-56946

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...