GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

SummaryGitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist ingit/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is thischeck him he is only call from fetch, pull, push and clonefrom, everything else who build a gitargv from...

PT-2026-89497

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

Exploit for Server-Side Request Forgery in Openclaw

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy B...

MAL-2026-16052 Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

Linux Distros Unpatched Vulnerability : CVE-2026-80777

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is t...

CVE-2026-67279

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

EUVD-2026-72027

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279

MikroTik RouterOS is affected by a SSH pre-authentication rekey state bypass (CVE-2026-67279). The root cause is that the SSH service enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated remote client to ope...

SUSE CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

SUSE CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

PT-2026-86454

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An issue exists where the SSH server enters the connection protocol following a client-requested rekey without requiring user...

CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777

CVE-2026-80777 is a race condition in the Linux kernel's futex/pi subsystem. During exec() , there is a window between setting a task's futex exit state to OK and actually swapping its memory map (mm), during which the check comparing a waiter's mm against the owner's mm can return an incorrect r...

CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

EUVD-2026-71420

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

Linux Distros Unpatched Vulnerability : CVE-2026-76060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...