Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent - WLS Security is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attacke...

PT-2026-63410

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

Oracle Linux 10 : vim (ELSA-2026-28210)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28210 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete -...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Repo.archive, Repo.itercommits, Repo.blame, and Git.lsremote call paths in git/repo/base.py, git/objects/commit.py, and git/cmd.py...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...

EUVD-2026-46336

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-47392

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

MAL-2026-10988 Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14 package.json declares scripts.preinstall as node./dist/index.d.js, which runs automatically on npm install. dist/index.d.js contains a base64-encoded...

GLPI <=10.0.2 - Remote Command Execution

GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...

EUVD-2026-46118

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2765)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...

EulerOS Virtualization 2.12.0 : vim (EulerOS-SA-2026-2811)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...

EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-2873)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

PT-2026-62103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An issue exists in the audit file upload functionality where a filename provided during the upload process is not properly sanitized before being used in system...

DEBIAN-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...