CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535

IBM Db2 is vulnerable to a stack-based buffer overflow in the setgid helper db2flacc, enabling privilege escalation from an unprivileged shell. Affected products/versions include IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.4 (Linux/Unix; Windows not affected). CVE-2026-10535, CWE-121, has a base CVSS v...

SUSE CVE-2026-44985

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: funcr http.Request bool return true , accepting upgrade requests from any origin. Combined with the JWT cookie using SameSite: Lax, this enables...

SUSE CVE-2026-48709

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not cal...

CVE-2026-12940 Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

EUVD-2026-51240

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

SUSE CVE-2026-54088

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplie...

SUSE CVE-2026-54090

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured e.g. /bin/sh -c, the command allowlist can be bypassed through shell metacharacters. The allowlist...

SUSE CVE-2026-55654

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI Generic Security Service Application Programming Interface indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific...

JLSEC-2026-907

A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding...

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

EUVD-2026-50564

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check...

GHSA-XC5W-4V5W-7X65 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

EUVD-2026-51108

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

EUVD-2026-51041

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...