ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

CVE-2026-24061

CVE-2026-24061 GNU inetutils-telnetd - Contournement d'authentification à distance Un outil de recherche en sécurité pour exploiter CVE-2026-24061, une vulnérabilité critique de contournement d'authentification à distance dans GNU inetutils-telnetd qui permet un accès instantané à un shell root...

CVE-2026-90809

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-52806

Gogs RCE — Injection d'argument dans git rebase CWE-88 Exécution de code à distance authentifiée contre Gogs est interprétée par Git comme le drapeau --exec plutôt qu'un argument positionnel, ce qui entraîne l'exécution de sh -c après chaque commit rejoué pendant le rebase. Comment l'exploit...

EUVD-2026-77759

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-90809

HKUDS nanobot (versions up to 0.2.1) is affected by an argument injection vulnerability in the ExecTool component, specifically in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The flaw allows a remote attacker with no privileges or user interactio...

cve-2024-4577-lab

Plan de l'environnement root@kitploit: Conteneur système d'exploitation : ubuntu:22.04 sous Windows WSL2. Couche serveur Web : Apache2 avec modactions, modcgi et modcgid forcés globalement dans le fichier apache2.conf principal. Interpréteur de langage : PHP 8.1.2 fonctionnant strictement en mode...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — инструмент массовой эксплуатации Cockpit Неаутентифицированное удалённое выполнение кода через инъекцию аргументов командной строки SSH Версии Cockpit 327 – 359 | CVSS 9.8 критический | CWE-78 Инструмент массовой эксплуатации CVE-2026-4631 в веб-сервисе Cockpit cockpit-ws, порт...

CVE-2024-4577

CVE-2024-4577, Injection d'arguments dans PHP-CGI root@kitploit: ./CVE-2024-4577.sh /path/to/domains-list POC : root@kitploit: POST /test.hello?%ADd+allowurlinclude%3d1+%ADd+autoprependfile%3dphp://input HTTP/1.1 Host: host User-Agent: curl/8.3.0 Accept: / Content-Length: 23 Content-Type:...

CVE-2024-4577-EXPLOIT

CVE-2024-4577 — Удаленное выполнение кода через внедрение аргументов PHP CGI RCE В определенных версиях PHP 8.1. до 8.1.29, 8.2. до 8.2.20 и 8.3. до 8.3.8 существует критическая уязвимость при использовании PHP с Apache и PHP-CGI на Windows. Если система настроена на использование определенных...

CVE-2026-24061

CVE-2026-24061 - Обход аутентификации через инъекцию аргументов в telnetd GNU InetUtils Версии GNU InetUtils с 1.9.3 по 2.7 уязвимы к удаленному обходу аутентификации в сервере telnetd. Демон telnetd неправильно очищает переменную окружения USER перед передачей её в качестве аргумента командной...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

Security update for ansible-core

This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

RHEL 10 : ansible-core (RHSA-2026:67465)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67465 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SS...