PT-2026-80962

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu...

PT-2026-80965

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-79818

Name of the Vulnerable Software and Affected Versions 4MOSAn GCB Doctor affected versions not specified Description An OS Command Injection issue exists where unauthenticated remote attackers can execute arbitrary system commands on the server. This is possible through a parameter in an unremoved...

PT-2026-80002

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

PT-2026-80964

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-80942

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh start speed test function. The vulnerability is caused by insufficient sanitization of the meshdevice index and meshdevice ip fields before command execution. A remote attacker can trigger this vulnerability via...

PT-2026-81032

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process command opts function in tools/tiffcrop.c...

PT-2026-80938

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event code field is concatenated into a system command. A remote attacker can trigger this...

PT-2026-80952

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability v...

PT-2026-81043

First off, this is not a criticism of GNOME or the Epiphany development team. String parsing bugs happen to literally every browser engine out there. But the new CVE-2026-77682 is a textbook example of why built-in browser password vaults are a bad idea structurally. The vulnerability is in the...

RHEL 10 : python3.12 (RHSA-2026:58902)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58902 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

PT-2026-80943

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2026:0298-1 Rating: important References: 1275913 Cross-References: CVE-2026-76017 CVE-2026-76018 CVE-2026-76019 CVE-2026-76020 CVE-2026-76021 CVE-2026-76022 CVE-2026-76023 Affected Products: openSUSE Backports...

PT-2026-79809

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

PT-2026-80948

Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray apm component. The vulnerability is caused by insufficient validation of UDP message content after START SPEED TEST before command execution. A remote attacker can trigger this vulnerability via a crafted messag...

PT-2026-80949

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...

PT-2026-80986

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...

PT-2026-80944

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Memory is becoming a default subsystem in deployed LLM agents to provide persistent personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires onl...

PT-2026-80959

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...