EUVD-2026-54210

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

EUVD-2026-54275

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

EUVD-2026-54247

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

MAL-2026-13491 Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

How to Apply Custom Settings in Veeam Backup for Microsoft 365 Using Set-VBOConfigurationParameter

Purpose This article explains how to use the Set-VBOConfigurationParameter cmdlet to apply a custom configuration setting within a Veeam Backup for Microsoft 365 deployment. Solution How the Scripts in This Article Are Used Every script in this article begins with the same three variables, which...

Security update for bouncycastle (critical)

openSUSE security update: security update for bouncycastle ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21538-1 Rating: critical References: bsc1272700 bsc1272701 bsc1272702 bsc1272703 bsc1272704 bsc1272705 bsc1272707 bsc1272708 bsc1272709...

📄 LightFTP Server 2.4 Race Condition

LightFTP versions through 2.4 current master, commit d28c5e0 contain multiple data race conditions in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. !/usr/bin/env python3 LightFTP Server 2.4 Race...

UBUNTU-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

Security update for perl-Mojo-JWT (moderate)

openSUSE Security Update: Security update for perl-Mojo-JWT Announcement ID: openSUSE-SU-2026:0279-1 Rating: moderate References: 1271935 Cross-References: CVE-2026-9537 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

gpsd-minimal security update

3.26.1-2.0.1.el98.1 - Replaced upstream reference Orabug: 35865525 1:3.26.1-2.el98.1 - fix command injection in gpsprof CVE-2026-58459 1:3.26.1-2 - fix buffer overflow in NMEA2000 driver CVE-2025-67268 - fix integer underflow in handling of Navcom packets CVE-2025-67269...

📄 DCMTK 3.7.0 Path Traversal

dcmsend in DCMTK DICOM ToolKit version 3.7.0 is vulnerable to path traversal when it is instructed to read input files from a specially crafted DICOMDIR. This can lead to unauthorized disclosure of readable DICOM objects, including protected health information. Advisory ID: SYSS-2026-047 Product:...

UBUNTU-CVE-2026-64653

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

UBUNTU-CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

📄 DCMTK 3.7.0 RLE Encoder Heap Out-of-Bounds Read

A proof of concept for a heap out-of-bounds read vulnerability in DCMTK version 3.7.0. The vulnerability is caused by an integer overflow in the RLE encoder's expected-size sanity check. By supplying crafted image dimensions that cause the 32-bit size calculation to wrap around, an attacker can...

LightFTP Server 2.4 Race Condition

Summary Small x86-32/x64 FTP Server. Description LightFTP through version 2.4 current master, commit d28c5e0 contains multiple data races in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. In...

Security update for perl-Mojolicious (moderate)

openSUSE Security Update: Security update for perl-Mojolicious Announcement ID: openSUSE-SU-2026:0278-1 Rating: moderate References: 1271431 Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE: 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products:...

Progress LoadMaster Command Injection Vulnerability

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints...

UBUNTU-CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...