38412 matches found
Low: Red Hat Security Advisory: libxml2 security update
An update for libxml2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...
PT-2026-97392
Name of the Vulnerable Software and Affected Versions Frictionless versions prior to 5.20.0rc1 Description An OS command injection flaw exists in the explore console command. An attacker can execute arbitrary operating system commands by providing a crafted Data Package descriptor. By placing she...
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...
Linux Distros Unpatched Vulnerability : CVE-2026-94106
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...
PT-2026-97588
Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Insufficient input sanitization of shell metacharacters in the CLI scripting component allows authenticated users to break out of restricted execution contexts on managed switches. An attacke...
CVE-2026-82369: Improper Neutralization of Special Elements used in an OS Command
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...
RHEL 9 : libxml2 (RHSA-2026:70639)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70639 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...
CVE-2026-50187
A flaw was found in the dotenv plugin of Oh My Zsh. A remote attacker could craft a malicious .env file containing arbitrary shell commands. When a user changes into a directory containing this file, the dotenv plugin processes it, leading to the execution of these commands with the user's...
CVE-2026-76802
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator...
CVE-2026-76802
The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its DAST template loading branch. When the -dast flag is enabled, the loader fails to enforce cryptographic signature checks on templates containing both a fuzzing: block and an unsigned code: block. This allows ...
Exploit for OS Command Injection in Vsftpd_Project Vsftpd
CVE-2011-2523 — vsftpd 2.3.4 Backdoor Exploit !Pythonhttps...
CVE-2026-80151
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...
CVE-2026-80144
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented...
CVE-2026-80143
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented...
CVE-2026-80151 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...
EUVD-2026-84509
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: texlive-base (UTSA-2023-002148)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002148 advisory. LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua le...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: sssd (UTSA-2026-090441)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090441 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. This flaw allows an...
