PT-2026-83057

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can craft a message header that causes the IMAP THREAD command to consume CPU resources disproportionate to the message size. When a mail client executes the THREAD command on the...

PT-2026-82868

Name of the Vulnerable Software and Affected Versions NUMail versions prior to 202602162 Description NUMail contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating-system commands on the server. This occurs because the applicati...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83334

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description An authenticated attacker can execute arbitrary operating system commands within the server process. This occurs by saving a flow containing a crafted value in the type field and...

PT-2026-83273

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

PT-2026-83256

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: storm (UTSA-2026-093009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093009 advisory. A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

UBUNTU-CVE-2026-40017

An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...

UBUNTU-CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

openSUSE 16 Security Update : v2ray-core (openSUSE-SU-2026:21653-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21653-1 advisory. Changes in v2ray-core: - Update version to 5.53.0 Add X-Forwarded-For support to gRPC transport Add Stream based Packet Addr for UDP Connections...

PT-2026-83268

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote...

PT-2026-83269

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web smtp test post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the advanced/curl endpoint. The url parameter is not adequately sanitized before being passed to the system's curl execution routine. An authenticated attacker can bypass space restrictions using shell va...

PT-2026-83068

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can send an invalid IMAP URLFETCH command, causing the system to include uninitialized memory in the error response returned to the client. This can lead to the...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

The vulnerability of the d6_dhcpc.c component in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure

The vulnerability in the d6dhcpc.c component of the UNIX command-line utilities in BusyBox relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-83055

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can cause CPU consumption and subsequent service degradation or denial of service for IMAP by using the IMAP LIST command. Recommendations Update to version...

...[ More ]

This Metasploit module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. T...

PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...