TencentOS Server 4: rust (TSSA-2026:0951)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0951 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Debian dla-4766 : cyrus-admin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected]...

How to Allow Company Users to Open Veeam Backup & Replication Web UI Wizards From Veeam Service Provider Console

Purpose This article documents how to allow company users to open Veeam Backup & Replication web UI wizards from Veeam Service Provider Console for backup servers managed by their company. Starting with Veeam Service Provider Console 9.3, users can perform restore operations by redirecting to the...

MiracleLinux 8 : pcp-5.3.7-22.el8_10.5 (AXSA:2026-1724:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1724:03 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets...

openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21696-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: -...

PT-2026-84408

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A command sanitization bypass exists in the API of HPE Networking Fabric Composer. This flaw allows an authenticated user with low privilege operator permissions to...

VulnCheck KEV: CVE-2025-60702

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and concatenates it directly into a ping system command executed via...

PT-2026-84486

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A flaw in the command line interface allows for the improper processing of malformed input, which could enable an attacker to execute arbitrary commands with root privileges. Recommendations A...

PT-2026-84354

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description OpenAI Codex Desktop can execute attacker-controlled Git hooks due to automated Git operations trusting the repository local core.hooksPath setting. If a us...

PT-2026-84286

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

PT-2026-84157

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

PT-2026-84499

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0933)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0933 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

VulnCheck KEV: CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21705-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21705-1 advisory. Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: -...

Alibaba Cloud Linux 3 : 0264: freerdp (ALINUX3-SA-2026:0264)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0264 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-64624: FreeRDP before 3.28.0 trea...

TencentOS Server 2: freeipmi (TSSA-2026:0936)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0936 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...