CVE-2026-76055

CVE-2026-76055 is an OS command injection in the package manager component of Black Duck blackduck-c-cpp prior to version 3.0.7. Filesystem paths encountered while traversing a scanned build directory are interpolated into shell command strings without quoting or escaping , allowing shell metacha...

CVE-2026-76055

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...

EUVD-2026-64894

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

CVE-2026-76054 affects Black Duck blackduck-c-cpp versions 1.0.17 through 3.0.6 . When the Black Duck API token is supplied via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable, it is inherited by subprocesses launched during build capture and signature scanning. An actor able to exec...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-72854

A flaw was found in msgpack-c. An integer overflow vulnerability exists in the msgpackunpackerexpandbuffer function. This flaw can lead to an undersized memory buffer being allocated, even though the system reports a successful reservation. If an attacker can influence the length provided to the...

Linux kernel md/raid1.c DoS

The vulnerability in the md/raid1.c component of the Linux kernel lies in the fact that resources are not released after their useful lifespan has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the dpaa2caamprobe function in the caamalgqi2.c component of the Linux kernel is related to the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-80890

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...

CVE-2026-76054: Invocation of Process Using Visible Sensitive Information

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

PT-2026-80889

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

CVE-2026-76055: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...

OpenEXR internal_b44.c DoS

The vulnerability of the internalb44.c component of the OpenEXR image storage software, which handles images with a wide dynamic range of brightness, is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-84878

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.1 through 2.44 Description Calling the tdelete function on a sufficiently deep tree may result in writing one pointer past the end of an alloca-allocated array on the stack, potentially causing the application to crash...

CVE-2026-68768

hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...

SUSE CVE-2026-72854

msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...

Apkx-Hunter v2.7.2

APKX-Hunter v2.7.1 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...

On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study

Modern software systems require earlier and more scalable vulnerability severity assessment to reduce exposure to high-impact security flaws. Security analysts typically assign CVSS scores, but this manual triage does not scale with the growth of disclosed vulnerabilities and often depends on clo...