Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages JSP web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management PLM software, according to new findings from ReliaQuest. The cybersecurity company...

Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...

MAL-2026-14194 Malicious code in system-performance-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...

PT-2026-78363

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or within an extracted archive using a name that contains a single quote followed by shel...

PT-2026-78372

Name of the Vulnerable Software and Affected Versions Renovate versions 37.158.0 through 37.198.0 Description Command injection is possible in the helmv3 manager's handling of registryAliases. Attackers with commit access can manipulate registryAliases keys using unquoted shell metacharacters to...

PT-2026-78624

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A shell metacharacter injection flaw allows a local attacker to execute arbitrary commands on the system. Recommendations At the moment, there is no information...

PT-2026-78650

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.75 Description An authenticated user with attachment upload privileges can execute arbitrary commands as the Wekan server process on deployments where an external scanner is configured. The issue occurs in...

PT-2026-78410

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

CVE-2026-68560: Improper Neutralization of Special Elements used in an OS Command

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

Linux Distros Unpatched Vulnerability : CVE-2026-68939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv- version-file-read accepts shell glob metacharacters in...

Linux Distros Unpatched Vulnerability : CVE-2026-74965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

CVE-2026-43961: Improper Control of Generation of Code

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-16875: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...

CVE-2026-65611: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-65612: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

PT-2026-78645

Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9 Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote ca...

VulnCheck KEV: CVE-2026-60004

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...

CVE-2026-76228: Improper Neutralization of Special Elements used in an OS Command

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...