CentOS Linux 7 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (CENTOS7:CLSA-2026:1793090225)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793090225 advisory. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

PT-2026-133516

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 25.1.1.3 Ivanti Connect Secure versions prior to 22.8R2.6 Description The software uses predictable filenames, which allows a remote authenticated attacker to upload files containing controlled content t...

Juniper SSR < 7.0.5 / 7.1.x < 7.1.7 / 7.2.x < 7.2.3 Multiple Vulnerabilities (JSA112183)

The version of Juniper Session Smart Router SSR or Session Smart Conductor installed on the remote host is prior to 7.0.5, 7.1.x prior to 7.1.7, or 7.2.x prior to 7.2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the JSA112183 advisory. - An Improper Neutralization of...

CVE-2026-119560: opnsense core: OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append…

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...

CVE-2026-119335: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "$FTLPID" : "^:digit:", but this rejects only values whose...

PT-2026-133498

Name of the Vulnerable Software and Affected Versions OPNsense core versions prior to 26.7.9 Description Authenticated users with page-services-ntp-gps or PPS privileges can perform a configuration injection. By embedding carriage return and line feed CR/LF characters into the fudge and refid...

CVE-2026-63378: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctrsession cookie can submit arbitrary Python source in the scriptcode field of POST /api/react/execute-script, witho...

CVE-2026-119409: opnsense core: OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System:…

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that...

Rclone 1.75.1 Path Traversal

Rclone versions before 1.75.2 contain a path traversal vulnerability in serve webdav that can permit writes above the served root. This tool performs offline inventory-based version exposure assessment...

PT-2026-134242

Name of the Vulnerable Software and Affected Versions TAKO AI Agent for Okta versions prior to 3.0.1-beta Description Authenticated users with a valid fctr session cookie can execute arbitrary Python code without administrator privileges. By sending a request to the 'POST /api/react/execute-scrip...

PT-2026-133628

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

Redmi K90 HyperOS 4.0.5.0 Temporary Root Research

Redmi K90 HyperOS versions 4.0.0.27, 4.0.0.34, and 4.0.5.0 are documented in experimental temporary-root compatibility research related to CVE-2026-64560. The material contains testing criteria and firmware observations but no exploit code or executable payloads...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on t...

[SECURITY] Fedora 45 Update: kio-admin-26.08.2-1.fc45

kio-admin implements a new protocol "admin:///" which gives administrative access to the entire system. This is achieved by talking, over dbus, with a root-level helper binary that in turn uses existing KIO infrastructure to run file:// operations in root-scope...

CVE-2026-61707

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by customeruser, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin o...

CVE-2026-61707

SOCFortress CoPilot versions prior to 0.1.76 are vulnerable to stored case-report template injection . The /case-report-template/upload route fails to validate template content, allowing a customer_user to upload and replace legitimate templates in a shared global store. When an admin or analyst ...