CVE-2026-77521 MaxKB: Prompt-injectable agent can lead to command execution

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...

CVE-2026-79916

MaxKB is an open-source enterprise AI assistant. Prior to 2.10.5-lts , authenticated workspace members can inject control characters into the AWS Bedrock access_key_id and secret_access_key fields. The _update_aws_credentials function writes these values to /root/.aws/credentials without safe par...

CVE-2026-55159

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55159

CVE-2026-55159 affects luci-app-adblock-fast , a WebUI for a DNS-based ad-blocker on OpenWrt (compatible with dnsmasq, smartdns, or unbound). Prior to 1.2.4-2 , the luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument, serializi...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

EUVD-2026-84099

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

UBUNTU-CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

EUVD-2026-84006

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012

The Email::Sender::Transport::Sendmail Perl module (versions before 2.602 ) is vulnerable to arbitrary command execution on Windows systems. The issue resides in the _sendmail_pipe function, where the module concatenates the envelope sender and every recipient into a single command string that is...

CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

SUSE CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

SUSE CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...