mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user

A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrepsstreceiveaddress or wsrepsstdonor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

EUVD-2026-52481

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-51190: Improper Neutralization of Special Elements used in an OS Command

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

The vulnerability of the quote() function in the shell-quote npm package, which allows a hacker to execute arbitrary code.

The vulnerability of the quote function in the shell-quote npm package is related to the lack of data cleansing measures at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

RHEL 10 : mariadb10.11 (RHSA-2026:49522)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49522 advisory. MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation...

PT-2026-67515

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

EUVD-2026-52482

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

CVE-2026-52102: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

CVE-2026-52102

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

Joern 4.0.594

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-67418

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308

Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...