CVE-2026-78251: Use of Hard-coded Credentials

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

TencentOS Server 3: nghttp2 (TSSA-2026:0905)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0905 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

GLSA-202608-27 : GNU screen: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-27 GNU screen: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GNU screen. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

UnrealIRCd: Denial of service

Background UnrealIRCd is an Internet Relay Chat IRC daemon. Description A vulnerability has been discovered in UnrealIRCd. Please review the CVE identifier referenced below for details. Impact An attacker may be able to achieve denial of service. Workaround There is no known workaround at this...

GNU screen: Multiple Vulnerabilities

Background GNU screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells. Description Multiple vulnerabilities have been discovered in GNU screen. Please review the CVE identifiers referenced below for details. Impact Pleas...

CVE-2026-54770 affecting package python-webob for versions less than 1.8.11-1

CVE-2026-54770 affecting package python-webob for versions less than 1.8.11-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73193 affecting package perl-DBI for versions less than 1.652-1

CVE-2026-73193 affecting package perl-DBI for versions less than 1.652-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The SonicWall NetExtender Linux client is vulnerable to an Improper Link Resolution Before File Access (CWE-59) vulnerability within the NEService auto-upgrade process . This flaw arises because the process insecurely handles temporary files, allowing an attacker to manipulate file paths . The vu...

EUVD-2026-65960

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

CVE-2026-66153

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

PT-2026-81518

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description The NEService auto-upgrade process insecurely handles temporary files, which allows an attacker to manipulate file paths. Recommendations At the moment, there is no...

Fedora 44 : freeipa / samba (2026-903d904933)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-903d904933 advisory. Update to Samba 4.24.6 and rebuild of freeipa ---- This update contains no changes; it exists purely to keep the Fedora 44 freeipa package...

CVE-2026-66153: Improper Link Resolution Before File Access

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (August 2026)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

SUSE-RU-2026:3712-1 Security update 5.1.5 for Multi-Linux Manager Server

This update fixes the following issues: Release Notes Highlights: - Update to SUSE Multi-Linux Manager 5.1.5 Added known issue for missing BasicConstraints Critical flag Added a note about disk-check parameters semantics change Added a note about enabling FIPS mode after installing SUSE Multi-Lin...

PT-2026-80965

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute...