Security update for aliyun-cli (important)

openSUSE security update: security update for aliyun-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22140-1 Rating: important References: bsc1283596 bsc1284203 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE : 7.5...

Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Parasoft Continuous Testing Platform CTP from Parasoft United States, a closed-source commercial...

Synametrics Syncrify 6.2 - command execution

Title: Synametrics Syncrify 6.2 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

PT-2026-120733

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.0 Description An incomplete fix allows applications with pages disabled to render a script-capable URL through NuxtLink. This occurs when attacker-controlled input bound to the to variable is prefixed with an ASCII C...

RHEL 9 : sudo (RHSA-2026:86634)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86634 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

PT-2026-120919

This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This...

PT-2026-120159

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

Dawn Component Protected Information Access

The vulnerability in the Dawn component of Google Chrome and Microsoft Edge is related to errors in variable initialization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Dawn Component Protected Information Access

The vulnerability in the Dawn component of Google Chrome and Microsoft Edge web browsers is related to errors in variable initialization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

PT-2026-120656

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

Debian dsa-6575 : libnginx-mod-http-geoip - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6575 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6575-1 [email protected] https://www.debian.org/securit...

SUSE CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

SUSE CVE-2026-110753

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.24. Vulnerability Details CVEID:CVE-2026-11541...

DEBIAN-CVE-2026-113120

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...