CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...

CVE-2026-110005

A flaw was found in Komodo. The periphery agent's container-management functionality passes container names directly into an operating system shell without proper escaping. An authenticated user with low privileges can supply specially crafted container names to execute arbitrary commands with ro...

CVE-2026-84731

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

EUVD-2026-102206

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

ROOT-APP-NPM-CVE-2026-33916 CVE-2026-33916 in handlebars - Patched by Root

Root has patched CVE-2026-33916 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-77310 CVE-2026-77310 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-77310 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-23369 CVE-2021-23369 in handlebars - Patched by Root

Root has patched CVE-2021-23369 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33937 CVE-2026-33937 in handlebars - Patched by Root

Root has patched CVE-2026-33937 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33940 CVE-2026-33940 in handlebars - Patched by Root

Root has patched CVE-2026-33940 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33939 CVE-2026-33939 in handlebars - Patched by Root

Root has patched CVE-2026-33939 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-7RX3-28CR-V5WH GHSA-7rx3-28cr-v5wh in handlebars - Patched by Root

Root has patched GHSA-7rx3-28cr-v5wh in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33938 CVE-2026-33938 in handlebars - Patched by Root

Root has patched CVE-2026-33938 in the handlebars package for Root:npm. Multiple fixed versions available...

CVE-2026-57155

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-58390

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-105474

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25, and 8.0.x below 8.0.12, when running PHP FPM SAPI with the main FPM daemon process running as the root user and child worker processes running as lower-privileged users, it is possible for the child processes to access memory...

Astra Linux – Vulnerability in multipath-tools

In versions of multipath-tools from 0.7.0 to 0.9.x, up to 0.9.2, local users could obtain root access, either alone or in conjunction with CVE-2022-41973. Local users who had access to write to UNIX domain sockets could bypass access controls and manipulate the multipath setup. This could result ...

Astra Linux – Vulnerability in runc-app

Runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, an attacker can trick runc into binding paths that are normally read-only or masked, allowing them to be...

Astra Linux – Vulnerability in docker.io

In Docker versions prior to 9.03.15 and 20.10.3, there is a vulnerability related to the --userns-remap option. This option allows access to the remapped root directory, enabling privilege escalation to the actual root directory. When using --userns-remap, if the root user in the remapped namespa...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: checks dot and dotdot of dxroot before making dir indexed Syzbot reports the following issue: ============================================ BUG: Unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D...