CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

EUVD-2026-62469

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-76228

Renovate versions >=32.124.0 before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) pass attacker-controlled distributionUrl values from gradle-wrapper.properties directly into a shell command (/bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url ), allowing shell command subst...

CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-65612 Shell Command Injection in nnn

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-65612

CVE-2026-65612 is a shell command injection in nnn (a terminal file manager). The root cause is an unsanitized filename variable that is embedded directly into a generated shell command when a file is opened with the preview-tabbed action. An attacker can place a file with a crafted name (contain...

CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-65611

nnn (terminal file manager) is vulnerable to shell command injection via an unsanitized path variable. An attacker can craft a directory name containing a single quote followed by shell syntax on a shared filesystem, removable media, or inside an extracted archive. When a victim navigates into th...

CVE-2026-65611 Shell Command Injection in nnn

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

EUVD-2026-62400

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-65611 Shell Command Injection in nnn

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-65611 Shell Command Injection in nnn

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Stata Command Injection via Unsanitized package in adopackageinstall SummaryThe adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python...

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

SummaryThe Glances action system lets an administrator configure shell commands that runwhen a monitoring threshold is crossed. The command is a Mustache template whosevariables are filled with runtime stat fields such as a process name, a containername or a filesystem mount point. Those fields a...

PYSEC-2026-3665 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

Malicious code in emoji-prints-fancy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...

MAL-2026-14298 Malicious code in emoji-prints-fancy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages JSP web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management PLM software, according to new findings from ReliaQuest. The cybersecurity company...

Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...