AlmaLinux 10 : vim (ALSA-2026:75769)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...

Linux Distros Unpatched Vulnerability : CVE-2026-105326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mail...

RHEL 9 : vim (RHSA-2026:75768)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:75768 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in ...

RockyLinux 10 : vim (RLSA-2026:75769)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...

Cisco ASA Argument Injection (CVE-2026-20016)

A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attack...

simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

GHSA-X6JW-M9V5-85VH simple-git unsafe-operation guard does not block trailer command configuration

Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...

EUVD-2026-89332

simple-git allows command execution through unblocked Git configuration includes...

NPM: simple-git allows command execution through unblocked Git configuration includes

NPM: simple-git allows command execution through unblocked Git configuration includes vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

EUVD-2026-89333

simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...

GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291 vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

EUVD-2026-91767

@nx/docker: OS command injection in the @nx/docker release pipeline...

GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

PYSEC-2026-4191

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

CVE-2026-105744

The Docling library (versions 2.94.0 through 2.132.0 ) is vulnerable to arbitrary file read/write and potential command execution when using the opt-in Tectonic engine to render untrusted TikZ. The root cause lies in docling/backend/latex/engines/tectonic.py, which fails to restrict TeX primitive...

CVE-2026-105744 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

CVE-2026-105744 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...