Security update for aliyun-cli (important)

openSUSE security update: security update for aliyun-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22140-1 Rating: important References: bsc1283596 bsc1284203 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE : 7.5...

Synametrics Syncrify 6.2 - command execution

Title: Synametrics Syncrify 6.2 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics...

Exasol Database 7.1.30 - command execution

Title: Exasol Database 7.1.30 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux Advisory: https://0day-rubbish.com/blog/exasol-database-default-credential-python-udf-os-popen-rce CVE: pending Description: Exasol Database 7.1.3...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792245431)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792245431 advisory. - In the Linux kernel, the following vulnerability has been resolved: virtioconsole: eliminate anonymous moduleinit & moduleexit Elimina...

PT-2026-120671

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

PT-2026-120670

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

SUSE SLES15 Security Update : python-hpack (SUSE-SU-2026:4593-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4593-1 advisory. This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation...

RHEL 9 : sudo (RHSA-2026:86634)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86634 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Parasoft Continuous Testing Platform CTP from Parasoft United States, a closed-source commercial...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

php:7.4 security update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support 1.5.2-1 - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available 1.5.1-1 - update to 1.5.1 - drop dependency on zlib-devel and bzip2-devel no more referenced in libzip.pc...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail 732 bytes. Any distro. Root. A straight-line logic flaw in the Linux kernel's authencesn cryptographic template enables an unprivileged local user to perform a precise, controlled 4-byte write into the page cache of any readable file — including setuid binaries. No race...

CVE-2026-24061

-c0392b?style=flat GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection Overview - Technical Analysis - Affected Versions - Usage - Remediation - References Vulnerability Overview CVE-2026-24061 is a critical authentication bypass vulnerability in the telnetd...

SUSE CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

SUSE CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...