3963 matches found
CVE-2026-100866
Versions of onefetch through 2.28.1 are vulnerable to terminal escape sequence injection . The root cause is that the application writes repository information field values to the terminal without removing control characters. Attackers can embed ANSI/OSC escape sequences in project manifest versi...
CVE-2026-100867 spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...
CVE-2026-100866: Improper Neutralization of Escape, Meta, or Control Sequences
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...
CVE-2026-95835
A flaw was found in kitty. This vulnerability leads to information disclosure, allowing a local attacker to capture sensitive credentials, such as passwords, entered into terminal prompts. The issue arises because the application's askpass escape sequence handler fails to verify the ownership and...
CVE-2026-80431
A flaw was found in kitty. This vulnerability allows a program outputting to the terminal to cause a Denial of Service DoS by sending a specially crafted Operating System Command OSC escape sequence. Due to missing boundary checks when handling text sizing commands with overly long character...
DEBIAN-CVE-2026-95832
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...
CVE-2026-95832 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...
AZL-104762 CVE-2026-98078 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...
CVE-2026-98078 ipvs: fix reversed sequence option serialization
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...
EUVD-2026-86908
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...
CVE-2026-98078
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...
CVE-2026-98078: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...
PT-2026-98741
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvs component where the hton seq function receives arguments in reverse order during version 1 sync sender operations for both sequence blocks. This error results...
Linux Distros Unpatched Vulnerability : CVE-2026-95832
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....
CVE-2026-61788 @bytebase/dbhub's read-only mode does not prevent database writes
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...
GHSA-G7F6-RXC4-QHPH Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...
CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...
CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...
CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...