Joern 4.0.592

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-76299

A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding...

RHEL 10 : openssh (RHSA-2026:47757)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47757 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

erlang -- SSH plaintext recovery attack against CBC ciphers

The Erlang/OTP team reports: The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 section 6. For CBC ciphers, a timing-safe "packet discard" mechanism CVE-2008-5161 mitigation ensures structural errors are indistinguishable from MAC...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

CVE-2026-67438

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438

OliveTin versions 3000.2.0 through 3000.17.0 expose a vulnerability where the checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions. This allows values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c co...

CVE-2026-10684

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

EUVD-2026-50445

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-10684 Out-of-bounds read in coredump shell when printing stored-dump target code

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str, a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgtcode is = 7 causes an...

CVE-2026-67192

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

EUVD-2026-50399

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...