CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

CVE-2026-73483

Summary of the vulnerability (CVE-2026-73483): Flowise (flows: flowise, flowise-components) versions

Linux Distros Unpatched Vulnerability : CVE-2026-63294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image o...

Vim < 9.2.0847 Arbitrary Command Execution (GHSA-r22p-fhw4-84p2)

The version of Vim installed on the remote host is prior to 9.2.0847. It is, therefore, affected by a vulnerability as referenced in the GHSA-r22p-fhw4-84p2 advisory. - runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with...

PT-2026-71423

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

ROS-20260813-73-0003

The vulnerability in podman is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21558-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21558-1 advisory. Changes in gitoxide: - Update to 0.56.0: Fixes CVE-2026-40034 boo1266434: the CommandForbiddenInModules trust check could be bypassed in...

PT-2026-71885

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized keys for the asterisk system user without reliably enforcing backup-only...

CVE-2026-13476

IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input...

CVE-2026-73330

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...

CVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

CVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17642

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17642

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-57532

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-73414

Shescape (JavaScript library) contains a vulnerability in getEscapeFunction (src/internal/win/cmd.js) where it fails to escape '(' and ')' when using escape/escapeAll on Windows with CMD or with shell: true when CMD is default. An attacker-controlled argument can break out of a parenthesized CMD ...

CVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...