🚨 CVE-2026-25706
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain.
This issue affects yast2-samba-client through 5.0.4.
🎖@cveNotify
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain.
This issue affects yast2-samba-client through 5.0.4.
🎖@cveNotify
🚨 CVE-2026-59680
An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping.
Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry.
This issue affects yast2-users through 5.0.8.
🎖@cveNotify
An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping.
Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry.
This issue affects yast2-users through 5.0.8.
🎖@cveNotify
🚨 CVE-2026-59681
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host.
Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.
🎖@cveNotify
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host.
Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.
🎖@cveNotify
🚨 CVE-2026-4813
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
🎖@cveNotify
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
🎖@cveNotify
www.incibe.es
Code injection in the Lutece Core
INCIBE has coordinated the disclosure of a critical-severity vulnerability in Lutece Core, an open pla
🚨 CVE-2026-82926
NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.
🎖@cveNotify
NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.
🎖@cveNotify
GitHub
fix(tee): reject invalid session in invoke to close NULL-deref DoS (#247) by bmolodan · Pull Request #248 · Samsung/mTower
Description
Fixes a HIGH-severity, unauthenticated denial of service of the secure world,
reachable from the non-secure world through the live cmse_nonsecure_entry
ioctl() veneer.
tee_ioctl_invoke(...
Fixes a HIGH-severity, unauthenticated denial of service of the secure world,
reachable from the non-secure world through the live cmse_nonsecure_entry
ioctl() veneer.
tee_ioctl_invoke(...
🚨 CVE-2026-82927
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.
🎖@cveNotify
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.
🎖@cveNotify
GitHub
fix(tee): validate non-secure pointers at the secure-world boundary (#249) by bmolodan · Pull Request #250 · Samsung/mTower
Description
Fixes a HIGH/CRITICAL break of the TrustZone-M isolation guarantee: a
non-secure caller can make the secure world read from and write to secure
memory on its behalf, through the live cm...
Fixes a HIGH/CRITICAL break of the TrustZone-M isolation guarantee: a
non-secure caller can make the secure world read from and write to secure
memory on its behalf, through the live cm...
🚨 CVE-2026-84165
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
🎖@cveNotify
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
🎖@cveNotify
www.incibe.es
Lack of authorisation in OpenNebula by OpenNebula Systems
INCIBE has coordinated the publication of a high-severity vulnerability affecting OpenNebula by OpenNe
🚨 CVE-2025-15613
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
🎖@cveNotify
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data.
🎖@cveNotify
GitHub
SSRF via Service Calls
### Summary
An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrat...
An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrat...
🚨 CVE-2026-10420
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.
🎖@cveNotify
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.
🎖@cveNotify
GitHub
fix: Validate TA-supplied pointers in secure-kernel syscalls by bmolodan · Pull Request #252 · Samsung/mTower
The copy helpers tee_svc_copy_to_user/tee_svc_copy_from_user and the live crypto syscalls (utee_hash_update/final, utee_cipher_init, cipher update, copy_in_attrs) dereferenced or memcpy'd T...
🚨 CVE-2026-11873
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
🎖@cveNotify
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
🎖@cveNotify
Redhat
CVE-2026-11873 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-84190
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
🎖@cveNotify
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
🎖@cveNotify
GitHub
Remote Code Execution via AboutController in LibreNMS
# Remote Code Execution via AboutController in LibreNMS
## Summary
A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administ...
## Summary
A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administ...
🚨 CVE-2026-84195
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.
🎖@cveNotify
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints, gaining full control over Kyverno policies and cluster resources.
🎖@cveNotify
GitHub
Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak)
### Summary
Kyverno's apiCall service mode automatically attaches the admission controller's ServiceAccount (SA) token to outbound HTTP requests. This results in unintended credential expo...
Kyverno's apiCall service mode automatically attaches the admission controller's ServiceAccount (SA) token to outbound HTTP requests. This results in unintended credential expo...
🚨 CVE-2026-18765
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection.
This issue affects E-OSB: before V02.26.07.08.01.
🎖@cveNotify
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection.
This issue affects E-OSB: before V02.26.07.08.01.
🎖@cveNotify
siberguvenlik.gov.tr
T.C. Siber Güvenlik Başkanlığı
Türkiye Cumhuriyeti Cumhurbaşkanlığı Siber Güvenlik Başkanlığı resmi web sitesi.
🚨 CVE-2026-19472
A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability
🎖@cveNotify
A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability
🎖@cveNotify
Rockwell Automation
SD1797 | Security Advisory | Rockwell Automation | US
ArmorStart® LT - Multiple Vulnerabilities
🚨 CVE-2026-51741
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
🎖@cveNotify
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-51742
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
🎖@cveNotify
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-51743
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-51744
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-51745
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-51747
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
🎖@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main · ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
🚨 CVE-2026-53682
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
🎖@cveNotify
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
🎖@cveNotify
Redhat
CVE-2026-53682 - Red Hat Customer Portal
CVE Details App