MAL-2026-17592 Malicious code in cryoto-toolbox (RubyGems)

RubyGems runs this gem's native extension script ext/cryoto-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17617 Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in coinmarket-utils (RubyGems)

RubyGems runs this gem's native extension script ext/coinmarket-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17602 Malicious code in hdkey-derive-helper (RubyGems)

RubyGems runs this gem's native extension script ext/hdkey-derive-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

CVE-2026-105740: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...

PT-2026-106219

Name of the Vulnerable Software and Affected Versions Chainguard Academy edu integrate-platform-docs composite GitHub Action versions from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff through commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 Description Improper neutralization of special element...

PT-2026-106235

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description Authenticated users can achieve Remote Code Execution RCE on the server by adding a Model Context Protocol MCP server using the "Stdio" transport. The command field is passed directly to bash -c "ex...

SUSE CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

GHSA-P58F-9548-MPM2 virtualenv bash and fish activation scripts execute commands embedded in paths

Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...

EUVD-2026-89461

virtualenv bash and fish activation scripts execute commands embedded in paths...

virtualenv bash and fish activation scripts execute commands embedded in paths

Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...

CVE-2022-1388

CVE-2022-1388 Checking and exploit for CVE-2022-1388 Installation: python3 -m pip install -r requirements.txt Usage Single : python3 cve.py s fullurl apicommand example python3 cve.py s http://127.0.0.1:8000/mgmt/tm/util/bash '"command":"run","utilCmdArgs":"-c id"' Mass : python3 cve.py m host li...

Rocky Linux 8.6 [CIQ] Security Update: virt-v2v / virt-v2v-bash-completion / virt-v2v-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0844)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260844 advisory. This advisory aggregates security fixes for the virt-v2v SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2022-0897, CVE-2022-2211,...

Rocky Linux 8.6 [CIQ] Security Update: libguestfs / libguestfs-appliance / libguestfs-bash-completion / etc Multiple Vulnerabilities (ciqsa-2026_0074)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260074 advisory. This advisory aggregates security fixes for the libguestfs SRPM in CIQ LTS 8.6. It addresses 7 CVEs: CVE-2024-3446, CVE-2013-4419, CVE-2011-4127,...

Rocky Linux 8.6 [CIQ] Security Update: libnbd / libnbd-bash-completion / libnbd-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0833)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260833 advisory. This advisory aggregates security fixes for the libnbd SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2022-23645, CVE-2022-0897, CVE-2021-3507,...

Rocky Linux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1777021155)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777021155 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 9 [CIQ] Security Update: bash / bash-debuginfo / bash-debugsource / bash-devel (crlsa-2023_0340)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230340 advisory. bash: a heap-buffer-overflow in validparametertransform CVE-2022-3715 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8.6 [CIQ] Security Update: libguestfs / libguestfs-appliance / libguestfs-bash-completion / etc Multiple Vulnerabilities (ciqsa-2026_0839)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260839 advisory. This advisory aggregates security fixes for the libguestfs SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2023-2700, CVE-2022-4144,...

AlmaLinux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1777021155)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777021155 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Linux Distros Unpatched Vulnerability : CVE-2026-102925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place...