CVE-2026-19036

Shibby Tomato CVE-2026-19036 affects the wanoptions component: the function sub_40F88C in /tmp/ppp/wanoptions is vulnerable when processing the ppp_custom argument, enabling OS command injection. The issue can be triggered remotely, and public exploits exist. The affected product/version is Shibb...

CVE-2026-19036 Shibby Tomato wanoptions sub_40F88C os command injection

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument pppcustom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may...

CVE-2026-19036 Shibby Tomato wanoptions sub_40F88C os command injection

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument pppcustom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via filename handling in the Gitblame, Hgblame, and Svnblame report generators. An attacker can execute arbitrary shell commands by supplying an untrusted file whose name contains shell metacharacters. When...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19035

CVE-2026-19035 affects Shibby Tomato 1.28.0000. The flaw is in the function new_qoslimit_start in /etc/qoslimit, where manipulating the argument new_qoslimit_enable enables OS command injection. Remote exploitation is possible and the exploit is publicly available; CVSS metrics indicate HIGH impa...

EUVD-2026-53867

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt...

Security update for rsyslog

This update for rsyslog fixes the following issues: CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite bsc1272414. Input sequence during oversize-frame recovery in imptcp can cause denial of service bsc1271910. Patch Instructions: To install this SUSE update u...

Security update for bind

This update for bind fixes the following issues: CVE-2022-3094: UPDATE message flood may cause named to exhaust all available memory bsc1207471. CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. CVE-2026-3592: amplification vulnerabilities via self-pointed...

CVE-2026-19034

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

Security update for openssl-3

This update for openssl-3 fixes the following issue HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for openssl-1_1

This update for openssl-11 fixes the following issue HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...

Exploit for CVE-2026-69098

CVE-2026-69098 — kotaemon unauthenticated deserialization RCE...

Exploit for CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation i...

CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

EUVD-2026-53844

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...