Alibaba Cloud Linux 3 : 0280: dracut (ALINUX3-SA-2026:0280)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0280 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-15816: A flaw was found in dracut. The die...

PT-2026-84153

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell exec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

TencentOS Server 4: rust (TSSA-2026:0951)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0951 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-83596

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server,...

CVE-2026-16658

A flaw was found in the community.proxmox Ansible collection's proxmoxpctremote connection plugin. The buildpctcommand method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command such a...

MAL-2026-15633 Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

CVE-2015-8562

CVE-2015-8562 - Reverse shell Python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: root@kitploit: Fecha de vulnerabilidad: 17/12/2015 Autor del exploit: anarc0der Versión: Joomla 1.5 a 3.4.5 CVE : CVE-2015-8562 Cómo usar: root@kitploit: Abre un terminal y escucha con nc...

MAL-2026-15622 Malicious code in spc_login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a20e34373650f3fda40b9ea351c7ccb15ae98292cd159863cb26c0c33ff8c1 package.json declares a preinstall hook "node preinstall.js || true" that runs unconditionally on npm install. preinstall.js filters process.env for...

Malicious code in spc_login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a20e34373650f3fda40b9ea351c7ccb15ae98292cd159863cb26c0c33ff8c1 package.json declares a preinstall hook "node preinstall.js || true" that runs unconditionally on npm install. preinstall.js filters process.env for...

SUSE-SU-2026:3900-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2023-42366: heap buffer overflow in the nexttoken function of editors/awk.c bsc1217586. - CVE-2026-38752: stack buffer overflow in the evaluate function of editors/awk.c bsc1271544. - CVE-2026-38753: use-after-free in the awksub function o...

Security update for busybox

This update for busybox fixes the following issues: CVE-2023-42366: heap buffer overflow in the nexttoken function of editors/awk.c bsc1217586. CVE-2026-38752: stack buffer overflow in the evaluate function of editors/awk.c bsc1271544. CVE-2026-38753: use-after-free in the awksub function of...

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

cowrie v3.0.12

.. SPDX-FileCopyrightText: 2014 Upi Tamminen [email protected] .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof [email protected] .. .. SPDX-License-Identifier: BSD-3-Clause Cowrie What is Cowrie Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute...

Important: rust-cargo-c

Issue Overview: libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

PT-2026-84137

Name of the Vulnerable Software and Affected Versions yast2-auth-client affected versions not specified Description An OS command injection flaw exists in the Auth::AuthConf function within src/lib/auth/authconf.rb. The issue occurs when the software assembles Samba net ads join, net ads lookup -...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and...