CVE-2026-53541

OliveTin , a web interface for executing predefined shell commands, is vulnerable to improper input validation in its executor. The filterToDefinedArgumentsOnly function in service/internal/executor/executor.go contains a special case that allows any user-supplied argument prefixed with ot_ to by...

EUVD-2026-64203

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

WordPress Broken Link Checker plugin < 2.4.12 - Unauthenticated RCE via Query Variable Injection vulnerability

Unauthenticated RCE via Query Variable Injection vulnerability discovered by Jakub Herman in WordPress Plugin Broken Link Checker versions 2.4.12...

SUSE CVE-2026-65610

nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression homelen - 1 is promoted to signed int and becomes -1 an...

SUSE CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3652-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3652-1 advisory. - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership...

ROS-20260821-73-0009

The vulnerability of the fillframeinfo function in the net/hsr/hsrforward.c module, which is part of the networking functions in the Linux operating system’s kernel, relates to the use of uninitialized variables. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-HMQ9-67W8-J5PW netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

Security update for podman

This update for podman fixes the following issues: CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. CVE-2026-57231: specially crafted image can trick podman run into leakin...

SUSE-SU-2026:3662-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...

CVE-2026-16932

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-16932

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 fail to properly validate the ODMDIR environment variable, allowing a local attacker with low privileges to execute arbitrary commands. CVSS 3.1 scores this HIGH (8.8), with impact on confidentiality, integrity, and availability. Exploitation status is not pro...

EUVD-2026-63389

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-64961 Authentication Bypass in ATutor

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

PT-2026-78897

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description Under certain circumstances, sensitive variables may be printed in clear-text within the deployment variable snapshot. Recommendations At the moment, there is no information about a...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...