PT-2026-121782

Name of the Vulnerable Software and Affected Versions ASUS router affected versions not specified Description An issue involving Cross-Site Request Forgery CSRF and OS Command Injection occurs when special elements used in an OS command are not properly neutralized. This allows an attacker to tri...

PT-2026-122109

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 10.1.16 and 10.1.21 Description A local privilege escalation issue exists in the zmmailboxdmgr launcher. The passwordless sudo interface fails to adequately restrict JVM arguments, allowing the Unix zimbra...

PT-2026-122110

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 10.1.16 and 10.1.21 Description A local privilege escalation issue in the MTA package allows the Unix zimbra account to execute arbitrary commands with root privileges. The installed sudo policy allows...

PT-2026-122119

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 10.1.16 and 10.1.21 Description A local privilege escalation issue exists in the optional dnscache package. The passwordless sudo policy allows the Unix zimbra account to pass arbitrary arguments to the...

PT-2026-122096

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

ConnMan buffer error vulnerability

ConnMan versions 2.0 and earlier contain a buffer error vulnerability. This vulnerability arises because the getdomains function fails to properly limit the length of the DOMAINLIST option when processing DHCPv6 REPLY. As a result, DNS label traversal can lead to out-of-bounds reads and writes in...

ca-certificates security update

2025.2.80v9.0.304-71.0.2 - eMudhra: add 'emSign ECC Root CA - G3' and 'Comodo AAA Services root' to blocklist 2025.2.80v9.0.304-71.0.1 - Resolve ELBA-2025-22492 Orabug: 38712242 - Update to CKBI 2.80v9.0.304 from NSS 3.114 - Adding: - Certificate 'TWCA CYBER Root CA' - Certificate 'TWCA Global Ro...

Zimbra Collaboration Suite permission and access control issue vulnerability

Zimbra Collaboration Suite versions 10.1.21 and earlier contain a vulnerability related to permission escalation and access control. This issue arises because the sudo policy in the ZCS MTA package permits unauthenticated execution of Postfix management commands under root privileges without any...

CGM CLININET code injection vulnerability

Versions of CGM CLININET prior to 2026.MS3 contain a code injection vulnerability. This vulnerability stems from code injection in the RunCGI.pm component, which dynamically imports modules specified via query parameters and executes code within untrusted data. As a result, attackers on adjacent...

Zimbra Collaboration Suite command injection vulnerability

Zimbra Collaboration Suite versions 10.1.21 and earlier contain a command injection vulnerability. This vulnerability arises because the passwordless sudo interface in the zmmailboxdmgr launcher accepts JVM parameters without adequate restrictions. Attackers can delay Jetty privilege downgrade,...

CVE-2025-30050: Improper Control of Generation of Code

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an...

Vulnerability related to CGM CLININET permission, authorization, and access control issues

CGM CLININET versions 2026.MS3 and earlier contain a privilege escalation and access control vulnerability. This issue arises because the service handling incoming HL7 messages runs with root privileges, but its permission settings are incorrect. As a result, scripts and configuration files can b...

PT-2026-121962

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the path pivot root function. The function reads the parents of new root and the caller's root to check if they are shared before verifying if the...

PT-2026-122040

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the device mapper ioctl implementation where the get result buffer function sets the data start variable to the size of struct dm ioctl without verifying the actual...

ca-certificates security update

2026.2.92v9.0.319-81.3 - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch 2026.2.92v9.0.319-81.2 - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates 2026.2.92v9.0.319-81 - Update to CKBI 2.92v9.0.319 from NSS 3.131.1 Removing: - emSign Root CA - C1 Adding: -...

Juniper Networks J-Web Arbitrary Command Execution

The vulnerability in the J-Web management web interface of Juniper Networks Junos OS is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

PT-2026-121800

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

Linux Distros Unpatched Vulnerability : CVE-2026-115378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious...

CVE-2026-110243

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

CVE-2026-107861

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...