3680 matches found
CVE-2026-102697
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...
CVE-2026-102697 Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...
CVE-2014-6271-EXPLOIT
CVE-2014-6271 - Shellshock 💣 Shellshock는 GNU Bash 셸의 치명적인 취약점입니다. 버전 4.3까지 영향을 미치며, 원격 공격자가 임의의 코드를 실행할 수 있도록 합니다. 이 취약점은 Bash가 환경 변수 값에서 함수 정의 뒤에 오는 문자열을 처리하는 방식에서 발생합니다. 🔍 상세 설명 Shellshock 취약점은 공격자가 특수하게 조작된 환경 변수를 통해 코드를 주입하고 실행할 수 있게 합니다. 이러한 변수는 다양한 경로를 통해 설정될 수 있습니다: OpenSSH의 sshd에 있는...
UBUNTU-CVE-2026-102422
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...
CVE-2026-102697: Incorrect Authorization
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...
CVE-2026-102925: Improper Neutralization of Special Elements used in an OS Command
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
PT-2026-102686
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...
shellshock-cve-lab
Shellshock CVE-2014-6271 ラボ このリポジトリには、CVE-2014-6271 用の小さな CGI ラボが含まれています。GNU bash 4.2 をコンパイルし、 Python の RFC-3875 スタイルのサーバーを通じて CGI スクリプトを提供し、リクエストヘッダーを CGI 環境変数にマッピングします。 Sentinel は、このシナリオを 2026-08-27 にゼロから構築したサンドボックスラボとして再現しました。 これは意図的に脆弱性を含むラボです。隔離されたローカル環境またはサンドボックス 環境でのみ実行してください。 実行 docker...
Exploit for CVE-2026-44011
CVE-2026-44011: Craft CMS authenticated RCE PoC This Python s...
TencentOS Server 4: environment-modules (TSSA-2026:1035)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1035 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CLEANSTART-2026-GG57088 Security fix for CVE-2016-0634 applied in: bash 4.4.12-r1
Security vulnerability affects the bash package. This issue is resolved in later releases. See references for vulnerability details...
PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths
The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...
virtualenv bash and fish activation scripts execute commands embedded in paths
The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...
Exploit for Path Traversal in Grafana
Grafana CVE-2021-43798 Plugin Enumerator A small Bash-based t...
PT-2026-100583
Security vulnerability affects the bash package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-102923
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13 Description The generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual...
openSUSE 16: openai-codex / openai-codex-bash-completion / etc (openSUSE-SU-2026:21870-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21870-1 advisory. Changes in openai-codex: Update to version 0.154.0: Experimental worktree support for isolated checkouts of new or forked sessions, with browse and resu...
terminalphone — Updated!
TerminalPhone Encrypted push-to-talk voice communication over Tor hidden services. TerminalPhone is a single, self-contained Bash script that provides anonymous, end-to-end encrypted voice and text communication between two or more parties over the Tor network. It operates as a walkie-talkie: you...