Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-054006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054006 advisory. In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers t...

CVE-2026-35867

A command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-LINK router AC1900_AZ2 V1.0.2 . The flaw allows an attacker on the adjacent network to inject shell metacharacters via a POST /goform/set_LimitClient_cfg request, even without administr...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...

EUVD-2026-76749

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

OS Command Injection

OmniRoute is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of attacker-controlled binary and versionCommand values before executing them with execFileSync, which allows an unauthenticated attacker under certain configurations to supply interpreter...

CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444

CVE-2026-90444 describes a shell metacharacter injection vulnerability in a file-transfer interface within an ICS/OT product (per CISA advisory ICSA-26-254-01). The interface requires valid credentials but does not restrict shell metacharacters in uploaded filenames. An automated process later co...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

SnowCrash

Snow Crash A Linux security project focused on privilege esca...

CVE-2026-89066

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-7863

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

EUVD-2026-76151

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...