151785 matches found
PT-2026-69125
Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description An OS command injection flaw exists in the Shell Allowlist Handler component within the nanobot/agent/tools/shell.py file. The issue resides in the ExecTool. guard command and ExecTool. spawn...
Progress LoadMaster Command Injection Vulnerability
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints...
MiracleLinux 9 : vim-8.2.2637-26.el9_8.10.ML.1 (AXSA:2026-1480:21)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1480:21 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162...
ImageMagick 7.x < 7.1.2-27 Memory Leak
The remote host has a version of ImageMagick installed that is 7.x prior to 7.1.2-27. It is, therefore, affected by a vulnerability. - ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger...
Linux Distros Unpatched Vulnerability : CVE-2026-15816
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly...
CVE-2026-67434
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
CVE-2026-63725
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
UBUNTU-CVE-2026-64653
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...
PHP_CodeSniffer gitblame report command injection via crafted filename
Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...
CVE-2026-67434
PHP_CodeSniffer contains a command-injection vulnerability in the Gitblame/Hgblame/Svnblame report generators prior to versions 3.13.6 and 4.0.2. In untrusted files, a filename with shell metacharacters can cause attacker-controlled commands to execute during report processing. Affected product: ...
CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
EUVD-2026-54170
PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...
Important: Red Hat Security Advisory: gpsd-minimal security update
An update for gpsd-minimal is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution
A flaw was found in gpsd, a service application that monitors one or more GPSes or AIS receivers. The gpsprof utility is vulnerable to a command injection. An attacker who can control the GPS device subtype value can embed malicious commands within the gnuplot plot title. When a user processes a...
CVE-2026-15733
WGDashboard is affected by a Remote Code Execution (RCE) vulnerability affecting version 4.2.3 and earlier. The issue is described as multiple OS command injections that allow an authenticated attacker to run arbitrary commands with root privileges. The CVSS context shows critical impact across c...
CVE-2026-15733 WGDashboard Remote Code Execution vulnerability
A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...
MAL-2026-13466 Malicious code in wormgpt-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c The package's bin entries wormgpt-cli, wormgpt, deepholegpt, wgpt map to bin/victim.js, which silently spawns a detached implant on any invocation...
CVE-2026-63725
The CVE describes an authenticated OS command injection in sysPass, where FileBackupService::doBackupFiles() constructs a tar command by directly inserting the config-provided backup path ($this->path) into the shell command without escaping or validation, and passes it to exec(). This path co...
CVE-2026-63725
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...