CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...

GHSA-J6CW-G6P4-7HCH Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...

CVE-2026-107815

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

CVE-2026-108158

The plugNmeet Server through 2.5.2 version is vulnerable to a path traversal vulnerability in the /api/whiteboard/convert endpoint. An authenticated meeting participant can provide crafted filePath values containing ../ sequences to force the server to convert arbitrary files into page images. Th...

CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

EUVD-2026-95906

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

CVE-2026-107814

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-39453

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...

EUVD-2026-95886

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling ilQtiMatImageSecurity that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htacces...

Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)

Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips, clickhouse-backup-fips, witness...

CVE-2026-39453 Red Lion Controls N-Tron 700 Series Reachable Assertion

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...

EUVD-2026-95814

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...