CVE-2026-75779

Improper Neutralization of Special Elements used in an OS Command “OS Command Injection” and Cross-Site Request Forgery CSRF in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root...

CVE-2026-75779

An OS Command Injection and Cross-Site Request Forgery (CSRF) vulnerability exists in an ASUS router model. An attacker can trick a logged-in administrator into visiting a phishing website, which triggers the router to execute arbitrary commands with root privileges . For further information and ...

Exploit for Use After Free in Google Android

CVE-2019-2215 on Skyworth / Coocaa TVs 9S60, Android 8.0 Te...

ROOT-APP-GOBINARY-CVE-2026-24051 CVE-2026-24051 in go.opentelemetry.io/otel/sdk - Patched by Root

Root has patched CVE-2026-24051 in the go.opentelemetry.io/otel/sdk package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-22868 CVE-2025-22868 in golang.org/x/oauth2 - Patched by Root

Root has patched CVE-2025-22868 in the golang.org/x/oauth2 package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-UU37609 On most platforms, Go uses the given system root certificates

CVE-2026-111943 affects multiple packages. On most platforms, Go uses the given system root certificates. See references for individual vulnerability details...

CLEANSTART-2026-RQ82484 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

EUVD-2026-108548

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

EUVD-2026-108549

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

EUVD-2026-108543

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

DJI CrystalSky ZS600C command injection vulnerability

Versions DJI CrystalSky ZS600C from 0.3.9.7 through 0.6.6.9 contain a security vulnerability. This vulnerability stems from the absence of authorization checks in the native Binder service android.dji.server. Processing routines fail to verify the caller’s identity or permissions; instead, they...

PT-2026-122097

OS command injection in the root-privileged 'hardware monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...

CVE-2025-30046: Execution with Unnecessary Privileges

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes...

CVE-2025-30054: Incorrect Permission Assignment for Critical Resource

CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these...

ca-certificates security update

2026.2.92v9.0.319-100.3 - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch 2026.2.92v9.0.319-100.2 - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates 2026.2.92v9.0.319-100.1 - Removing: AAA Certificate Services root CA - Removing: emSign ECC Root CA - G3 fr...

CGM CLININET deserialization injection vulnerability

Versions of CGM CLININET prior to 2026.MS3 contain a deserialization injection vulnerability. This vulnerability stems from the deserialization of untrusted data; attackers can send specially crafted serialized objects via the HTTP API used by the management module, potentially leading to arbitra...

CVE-2025-30047: Deserialization of Untrusted Data

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

Linux Distros Unpatched Vulnerability : CVE-2026-106589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related...

Fedora 45 : ca-certificates (2026-e57d2527d5)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e57d2527d5 advisory. Update ca-certificates to ca-certificates-2026.2.92v9.0.319-2.fc45 Remove emSign Root CS CA - G3 Additional code signing certificate that sign 2 of the...

CGM CLININET code injection vulnerability

CGM CLININET versions 2026.MS3 and earlier contain a code injection vulnerability. This vulnerability stems from improper control over code evaluation of Perl expressions in the ConvExpr function, potentially allowing authenticated attackers with elevated privileges to execute arbitrary code as...