HTTPS Fetch, Linux Command Shell, Bind TCP Inline

Fetch and execute an RISC-V 32-bit payload from an HTTPS server. Listen for a connection and spawn a command shell Module Options msf use payload/cmd/linux/https/riscv32le/shellbindtcp msf payloadshellbindtcp show actions ...actions... msf payloadshellbindtcp set ACTION msf payloadshellbindtcp sh...

HTTPS Fetch, Linux Chmod

Fetch and execute an RISC-V 32-bit payload from an HTTPS server. Runs chmod on the specified file with specified mode. Module Options msf use payload/cmd/linux/https/riscv32le/chmod msf payloadchmod show actions ...actions... msf payloadchmod set ACTION msf payloadchmod show options ...show and s...

CLSA-2026-1767627828 openssh: Fix of CVE-2025-61985

CVE-2025-61985: potential code execution using the ‘\0’ character in an ssh:// URI, when a ProxyCommand is used...

CLSA-2026-1767627264 openssh: Fix of CVE-2025-61985

CVE-2025-61985: potential code execution using the ‘\0’ character in an ssh:// URI, when a ProxyCommand is used...

Important: amazon-cloudwatch-agent

Issue Overview: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. CVE-2025-47914 SSH servers parsing GSSAPI authentication requests do not validate the number...

Medium: runfinch-finch

Issue Overview: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. CVE-2025-47914 SSH servers parsing GSSAPI authentication requests do not validate the number...

TP-Link TL-WR820N 2.80 Weak Cryptography

TP-Link TL-WR820N version 2.80 uses weak cryptographic algorithms for SSH...

GNU Privacy Guard 2.5.16

GnuPG the GNU Privacy Guard or GPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As suc...

PT-2026-27499

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Xen privcmd driver allows user space processes to issue arbitrary hypercalls. Normally, access is limited to root and the hypervisor denies hypercalls affecting other domains. Howeve...

PT-2026-26050

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel addresses an issue where off-path TCP source port leakage could occur via a SYN cookie side-channel. The resolution involves reintroducing TCP ports into the timestamp...

messagelib 信任管理问题漏洞

messagelib is a KDE open source application. A small C library for Linux. A trust management issue vulnerability exists in versions prior to messagelib 25.11.90, which stems from an SSL error that ignores the Google Safe Browsing Lookup API, which could lead to threat data spoofing...

CVE-2025-69412

KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API aka phishing API, which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration...

EUVD-2025-206080

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices...

CVE-2021-47744

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices...

CVE-2021-47744 Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices...

Expanding the Zero Critical Club to set a new standard for AppSec and SecOps teams

We are introducing Zero Code Criticals and Zero Time to Respond clubs to give every team a clear north star for secure development and rapid response...

Scalable Ultrafast Random Bit Generation Using Wideband Chaos-Based Entropy Sources

The exponential growth of data transmission and processing speeds in modern digital infrastructure requires entropy sources capable of producing large volumes of true randomness for information security. Chaotic emissions from semiconductor lasers are attractive in this context because of their...

EulerOS Virtualization 2.13.0 : openssh (EulerOS-SA-2025-2612)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993216)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993216 advisory. In the Linux kernel, the following vulnerability has been resolved: soc: amlogic: Fix refcount leak in meson-secure-pwrc.c In mesonsecurepwrcprobe, there is a refcou...

SUSE-SU-2026:20035-1 Security update for podman

This update for podman fixes the following issues: - CVE-2025-47914: lack of message size validation when SSH Agent server is processing new identity requests can lead to out-of-bounds read and an application panic bsc1253993. - CVE-2025-47913: receiving an SSHAGENTSUCCESS reply when the SSH clie...