Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...

SUSE CVE-2026-74602

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...

CVE-2026-74602

CVE-2026-74602 is a Linux kernel vulnerability in the ring-buffer subsystem. In rb_allocate_cpu_buffer(), the field bpage->order was left uninitialized (defaulting to 0). This becomes a problem when a ring-buffer uses subbuffers larger than PAGE_SIZE, because free_buffer_page() relies on the c...

CVE-2026-53541

OliveTin , a web interface for executing predefined shell commands, is vulnerable to improper input validation in its executor. The filterToDefinedArgumentsOnly function in service/internal/executor/executor.go contains a special case that allows any user-supplied argument prefixed with ot_ to by...

SUSE CVE-2026-65610

nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

CVE-2026-16932

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-16932

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 fail to properly validate the ODMDIR environment variable, allowing a local attacker with low privileges to execute arbitrary commands. CVSS 3.1 scores this HIGH (8.8), with impact on confidentiality, integrity, and availability. Exploitation status is not pro...

EUVD-2026-63389

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-64961 Authentication Bypass in ATutor

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

PT-2026-79035

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-76919 Use of Uninitialized Variable in Wireshark

ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76919

Wireshark is affected in versions 4.6.0–4.6.7 and 4.4.0–4.4.18. The ESS protocol dissector crashes due to a use of an uninitialized variable when processing malformed network traffic, enabling unauthenticated remote denial of service (CVSS 5.3). Exploitation in the wild is not documented in the p...

GHSA-FJ27-X67R-V4G5 vulnerabilities

Vulnerabilities for packages: busybox...

CVE-2026-74265

A flaw was found in the mana network driver of the Linux kernel. When creating a General DMA GDMA queue, the queue-id may not be properly initialized. If the queue creation fails before a valid ID is assigned, a subsequent cleanup operation can incorrectly use a zero ID, potentially corrupting th...

CVE-2026-16869

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are affected by a local privilege escalation flaw caused by improperly scrubbed environment variables, allowing low-privilege local attackers to execute arbitrary code with HIGH confidentiality, integrity, and availability impact (CVSS 7.8). No exploitation de...

CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...