Astra Linux – Vulnerability in Containerd

In containerd a industry-standard container runtime, before versions 1.3.10 and 1.4.4, containers launched through containerd’s CRI implementation via Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image might receive incorrect...

Astra Linux – Vulnerability in sudo

In Sudo before 1.9.12p2, the sudoedit also known as -e feature improperly handles additional arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR. This allows a local attacker to append arbitrary entries to the list of files to process. This can lead to...

Astra Linux – Vulnerability in LibreOffice

The Document Foundation LibreOffice has a vulnerability where environmental variables and arbitrary INI file values may be exposed to unauthorized actors. URLs can be created that expand environmental variables or INI file values, allowing potentially sensitive information to be exfiltrated to a...

Astra Linux – Vulnerability in PostgresSQL 11

Incorrect control of environment variables in PostgreSQL PL/Perl allows a non-privileged database user to modify sensitive process environment variables e.g., PATH. This often sufficient to enable arbitrary code execution, even if the attacker does not have a role as a database server operating...

Astra Linux – Vulnerability in Policykit-1

A vulnerability related to local privilege escalation was discovered in the polkit’s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to execute commands as privileged users according to predefined policies. The current version of pkexec does not proper...

Astra Linux – Vulnerability in Golang-1.19

The command go env command is documented as outputting a shell script containing the Go environment. However, go env does not sanitize the values it outputs. Therefore, executing its output as a shell script can lead to various malicious behaviors, including executing arbitrary commands or...

Credential Exposure Through Environment Variables

This plugin identifies credentials or secrets that are potentially exposed to malicious actors by environment variables on the target host. Attackers who establish a foothold on a target can escalate or move laterally using passwords, access tokens or API keys stored in local environment variable...

PT-2026-91396

Name of the Vulnerable Software and Affected Versions ESPHome Device Builder Dashboard versions prior to 1.0.12 esphome container versions prior to 2026.6.2 Description An authentication bypass occurs when upgrading the dashboard because the system stopped supporting the legacy $USERNAME and...

PT-2026-91729

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

EUVD-2026-42683

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft...

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

EUVD-2026-76122

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks by placing environment variable assignments before allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to trigger c...

PT-2026-89889

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-13745 Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

PT-2026-86758

Name of the Vulnerable Software and Affected Versions FreeIPA affected versions not specified Description A flaw exists in the idp-add command where input provided via the --organization and --base-url parameters is insufficiently validated. This input reaches a constrained eval function before...

CVE-2026-79678: Improper Neutralization of Directives in Dynamically Evaluated Code

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...