CVE-2026-15816

CVE-2026-15816 describes a vulnerability in dracut where the die() error-handling function writes its message into an initramfs emergency-hook script without proper shell-quoting. If the message contains data from the DHCP ROOT_PATH option, an adjacent attacker controlling a rogue DHCP server can...

Arbitrary Command Execution in GNU Bison

...

Malicious code in zyr-agent (npm)

Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at https://preview-chat-e8a10541-5396-4e8f-9ead-e5fbbcdb33d3.space-z.ai/api/v1...

Malicious code in wormgpt-cli (npm)

Source: amazon-inspector 6f76eeb5f3df3c8ebc673a73d88aeb6dd0eb89b2b350a36023e2fe2a42eb8ed1 The package bundles an implant module at src/implant/implant.js that spawns bash, powershell, and screen-capture child processes, consistent with remote command execution and host surveillance...

Malicious code in aitable-workflow-server (npm)

Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host reconnaissance and data beaconing to an external endpoint. The...

Malicious code in @avi892nash/aegis-grid-runner (npm)

Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON x-job-meta header containing a cmd string plus a gzipped cod...

EUVD-2026-54210

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-48097: Improper Neutralization of Special Elements used in an OS Command

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

PT-2026-69157

Name of the Vulnerable Software and Affected Versions Kakoune versions prior to 2026.05.21 Description The bundled autorestore.kak script, which is enabled by default, allows the execution of arbitrary shell and editor commands when a user opens a file if malicious backup files are present...

CVE-2026-48120: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...

PT-2026-69113

Name of the Vulnerable Software and Affected Versions NexTor IP Changer versions prior to 2.0.0 Description NexTor IP Changer is a command-line tool used to periodically rotate a user's IP address via the Tor network. The software contains a command execution flaw caused by the unsafe use of...

Linux Distros Unpatched Vulnerability : CVE-2026-15816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly...

Cisco Integrated Management Controller Command Execution Privilege Escalation

The vulnerability of the Cisco Integrated Management Controller IMC’s web management interface is related to improper validation of request parameters. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level...

Cisco Integrated Management Controller Command Execution Privilege Escalation

The vulnerability of the Web interface for managing Cisco Integrated Management Controllers involves insufficient validation of data entered by users. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and elevate their privileges to the root level...

PT-2026-69045

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description An injection issue exists in the virtual network driver of libvirt. The network XML parser fails to remove newline characters from DNS TXT record value attributes and SRV record domain/target...

CVE-2026-61477: Improper Neutralization of CRLF Sequences

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-61477: Improper Neutralization of CRLF Sequences

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

AZL-95462 CVE-2026-64654 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

DEBIAN-CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...