35000 matches found
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
[SECURITY] Fedora 43 Update: rust-pretty-git-prompt-0.2.2-11.fc43
Your current git repository information inside a beautiful shell prompt...
PT-2026-76672
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...
PT-2026-76723
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description In the glances/actions.py file, the GlancesActions.run function fails to respect the --disable-config-exec flag when processing on-alert action commands. This occurs because the function invokes secu...
PT-2026-76794
Name of the Vulnerable Software and Affected Versions Tenda W20E version V16.01.0.62782 Description The '/goform/telnet' endpoint allows unauthenticated remote attackers to activate the Telnet daemon, which enables them to obtain root shell access to the device. Recommendations At the moment, the...
PT-2026-76719
Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...
PT-2026-76810
Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...
CVE-2026-67966
The Tenda W20E V5.0 router (firmware V16.01.0.6(2782)) exposes /goform/telnet, which unconditionally starts telnetd and opens port 23 to the WAN, granting an unauthenticated, passwordless root shell. The flaw stems from manufacturing-test code retained in production firmware. No fix is available;...
CVE-2026-67966
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
EUVD-2026-60538
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
PT-2026-73433
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
[SECURITY] Fedora 44 Update: rust-pretty-git-prompt-0.2.2-11.fc44
Your current git repository information inside a beautiful shell prompt...
SJ-GPS-PRO-F11-Vulnerability
Independent vulnerability research on the SJRC F11 series consum...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-57062 vulnerabilities
Vulnerabilities for packages: gnupg...
Vim: Arbitrary Code Execution via Shell Keyword Lookup
...
PT-2026-73059
Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...