CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

CVE-2026-18980

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

CVE-2026-18980 nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

CVE-2026-18980 nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

EUVD-2026-53699

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

CVE-2026-18980

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

RLSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

gpsd security update

3.26.1-3.0.1.el102.1 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.1 - fix command injection in gpsprof CVE-2026-58459...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-3048)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

RHEL 9 : gpsd-minimal (RHSA-2026:51153)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51153 advisory. gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

Linux Distros Unpatched Vulnerability : CVE-2026-71311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filena...

OS Command injection

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

DEBIAN-CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...