Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.7.1. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

EUVD-2026-69249

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233

rpm is vulnerable to command execution via macro expansion in rpmuncompress -x. A local attacker can supply a specially crafted .gem filename containing RPM macro syntax ; when a user or automated workflow invokes rpmuncompress -x on that file, the macro expansion occurs during command constructi...

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-15809 Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

sbom-sentinel

sbom-sentinel !CIhttps://github.com/MUGHEESM/sbom-sentine...

OPENSUSE-SU-2026:21720-1 Security update for dovecot24

This update for dovecot24 fixes the following issues: Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mailmaxuseripconnections is reached bsc1276794. - CVE-2026-27852: DoS by sending mail with bad header bsc1276799. - CVE-2026-33604: SMTP smuggling via missing dot-stuffing after...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-18210

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2...

CVE-2026-16675

A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows...

CVE-2026-13336

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 अवलोकन एक पोस्ट-एक्सप्लॉयटेशन टूल जो Chromium के App-Bound Encryption ABE के पूर्ण, इन-मेमोरी बायपास को प्रदर्शित करता है। यह प्रोजेक्ट एक वैध ब्राउज़र प्रोसेस को सस्पेंडेड अवस्था में लॉन्च करने के लिए Direct Syscall-based Reflective Process...

CVE-2026-48908-joomla-sp-page-builder-detection

CVE-2026-48908 — Joomla SP Page Builder Validation and Detection Laboratory validation of CVE-2026-48908 in the Joomla SP Page Builder component, focused on technical evidence, event reconstruction, and defensive detection opportunities. The repository documents a controlled test in which the SP...

mcpshield

mcpshield अनपैच्ड MCP STDIO कमांड-इंजेक्शन दोष के लिए एक ड्रॉप-इन फिक्स CVE-2026-30623 परिवार, जिसे OX Security ने अप्रैल 2026 में "by design" के रूप में खुलासा किया था — कोई SDK पैच नहीं आ रहा है। एक लाइन इम्पोर्ट करें, और आपके Python ऐप द्वारा लॉन्च किया जाने वाला हर stdio MCP सर्वर, OS द्वारा...

pentest-writeups

pentest-writeups Kioptrix स्तर 1 राइटअप - CVE-2003-0201 Samba trans2open Kioptrix स्तर 1 — पेनेट्रेशन टेस्टिंग राइटअप लेखक: Amirbek Raxmatullayev @americo444 दिनांक: 2026-06-17 प्लेटफ़ॉर्म: VulnHub कठिनाई: शुरुआती उद्देश्य: रूट एक्सेस प्राप्त करना 1. पर्यावरण सेटअप घटक| विवरण ---|--- होस्ट ओएस|...

beelzebub v3.9.1

Beelzebub Deception Runtime Framework Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fideli...