CVE-2026-74965 Privilege escalation in the Shell Integration component

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of Mozilla Firefox and Mozilla Thunderbird . The issue impacts multiple versions, including Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerabil...

CVE-2026-74965 Privilege escalation in the Shell Integration component

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74965

Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

Linux Distros Unpatched Vulnerability : CVE-2026-68518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values...

PT-2026-76998

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description Privilege escalation...

EUVD-2026-61092

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

PT-2026-77145

Name of the Vulnerable Software and Affected Versions Pyenv versions prior to 2.8.0 Description The is version safe function in libexec/pyenv-version-file-read accepts shell glob metacharacters within .python-version values. Additionally, unquoted PYENV VERSION expansion in...

PT-2026-77158

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description The exec shell interact alias exec interact tool incorrectly returns ApprovalRequirement::Auto for its approval requirement. This behavior overrides the default required approval for tools...

Linux Distros Unpatched Vulnerability : CVE-2026-68519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for...

PT-2026-77315

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom components/blueprint studio/backend/git manager.py by interpolating the configured Git username and token directly into...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

FreePBX: From Unauthenticated SQL Injection to Root Shell...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-67966

Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

GHSA-GHVC-7HP8-2G2V vulnerabilities

Vulnerabilities for packages: wso2is, apache-tika, apache-tika-fips...

CVE-2026-71472

The flaw resides in postgresql-start.sh within the search-v2-operator of acm-search-v2-rhel9. The WORK_MEM string supplied via a Search Custom Resource is passed unvalidated into both a bash script and an SQL query, enabling authenticated hub administrators or CR editors to inject shell commands ...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...