CVE-2026-76220: Improper Neutralization of Argument Delimiters in a Command

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

PT-2026-78413

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

Linux Distros Unpatched Vulnerability : CVE-2026-75926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the...

PT-2026-78383

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf and movePathTo functions located in app/src/util/pathName.ts used by the 'move/link to' path-selection dialogs...

PT-2026-78358

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A low privileged attacker with remote access can exploit this flaw t...

ROS-20260819-73-0024

The vulnerability in Vim is related to the lack of measures taken to clean up data at the administrative level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-78359

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this flaw...

PT-2026-78645

Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9 Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote ca...

PT-2026-78382

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the '' block-reference autocomplete hint popup. The function genHintItemHTML app/src/protyle/hint/extend.ts concatenates a candidate block's name, alias, and mem...

PT-2026-78831

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.2.1 Description Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management componen...

ROS-20260819-73-0029

The vulnerability in Vim relates to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-16882: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-75149: Improper Control of Generation of Code

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-76372: Incorrect Permission Assignment for Critical Resource

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76404: Deserialization of Untrusted Data

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

ROS-20260819-73-0073

The vulnerability in Mariadb 11.8 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-76221: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

CVE-2026-76221: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

AlmaLinux 8 : sg3_utils (ALSA-2026:56130)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:56130 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformance...

Malicious code in typescipt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b97af3a328b837904c7860b7acbae33bea28afb53949905868867905c14be6 Package name typosquats typescript. The postinstall script scripts/postinstall.js XOR-decodes a download URL and a PowerShell launcher using key...