CVE-2026-61498 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gengraphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attacke...

CVE-2026-61498 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gengraphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attacke...

CVE-2026-60121

CVE-2026-60121 affects Vitec Flamingo 4.12.2. An unauthenticated OS command injection exists in admin/ajax/ping.php due to a double-evaluation flaw in shell argument handling: user-supplied host POST parameter is escaped with escapeshellarg() for a system wrapper, but the decoded value is taken f...

CVE-2026-60121

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg to the...

EUVD-2026-43496

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg to the...

RLSA-2026:38504 Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial o...

Malicious code in jest-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba The package [email protected] presents itself as a Jest test output formatter but its lib/collect.js imports childprocess and invokes execSync wit...

MAL-2026-10436 Malicious code in jest-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af1f270f7df9ee4f9088044964921e1b085b809ddb1d696e652326c58e5c0aba The package [email protected] presents itself as a Jest test output formatter but its lib/collect.js imports childprocess and invokes execSync wit...

MAL-2026-10439 Malicious code in react-hot-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051 index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any...

EUVD-2026-43329

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or...

SUSE-SU-2026:22596-1 Security update for libxml2

This update for libxml2 fixes the following issues - CVE-2026-6732: crafted XSD-validated document can cause a denial of service bsc1262719. - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

SUSE-SU-2026:22636-1 Security update for libxml2

This update for libxml2 fixes the following issues - CVE-2026-6732: crafted XSD-validated document can cause a denial of service bsc1262719. - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

Malicious code in trinity-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d576c0487668f599137a479e17ddc1335935fdec631f7d5adfa9e73049d7652 On npm install, the package's preinstall lifecycle reads a hex-encoded command string from preinstall.json, decodes it via Buffer.from..., 'hex', and...

PT-2026-59164

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 2025-09-03 contains a command injection vulnerability CWE-78 in the Executor.run method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper...

PT-2026-59585

Summary run python in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "" and passing it to subprocess.run..., shell=True. The escaping logic only handles and ", leaving $ and backtick substitutions unescaped, allowing arbitrary OS command executio...

PT-2026-59132

Summary Dulwich's ProcessMergeDriver substitutes the file path from the git tree, controllable by an attacker via a malicious branch into the merge driver command via the %P placeholder and executes it with subprocess.run..., shell=True. An attacker who can cause a victim to merge an untrusted...

PT-2026-59530

Summary The markdown table to image tool accepts a caller-controlled path parameter and passes it directly to get html table image: python pptagent/mcp server.py:127-143 def markdown table to imagemarkdown table: str, path: str, css: str - str: """ Args: path str: The file path where the image wi...

PT-2026-59584

Summary The execute command function in shell tools.py calls os.path.expandvars on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False line 88 for security. This allows exfiltration of secrets stored in environment...

PT-2026-59180

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

📄 Mara CMS 7.5 Shell Upload

Python exploit for CVE-2020-25042 targeting Mara CMS version 7.5. The script automates the complete authenticated attack chain by retrieving the login shash, requesting the server-generated login salt, computing the required authentication hashes, logging in as an administrator or manager,...