75584 matches found
PT-2026-78402
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A command execution issue exists in the check unsafe options guard. This guard can be bypassed by combining a single-character kwarg with split single char options=False. An attacker can provide a...
PT-2026-78411
Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...
PT-2026-78358
Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A low privileged attacker with remote access can exploit this flaw t...
PT-2026-78447
Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description Authenticated attackers can execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync command binary forwards this inp...
The vulnerability of CGI programs in microprogramming software for network devices from Zyxel allows a hacker to execute arbitrary commands.
The vulnerability of CGI programs in microprogramming software for network devices from Zyxel relates to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
MiracleLinux 8 : sg3_utils-1.44-6.el8_10.1 (AXSA:2026-1578:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1578:01 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Tenable has extracted the preceding description...
PT-2026-78586
Name of the Vulnerable Software and Affected Versions ICEcoder version 8.1 Description An unauthenticated remote code execution issue allows attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF Cross-Site Request Forgery validation bypass, and unsanitized command...
PT-2026-78727
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Description A user without admin or power roles can trick another user...
Linux Distros Unpatched Vulnerability : CVE-2026-53533
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses...
CVE-2026-55426
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...
CVE-2026-53455
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...
CVE-2026-55426
The shell_exec() function in linuxfabrik-lib splits command strings on pipe characters, enabling command injection via attacker-controlled arguments (e.g., --repo '|touch /root/nagios-was-here|') in plugins like restic-check. If a plugin is in the sudoers file, a compromised nagios/icinga account...
CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...
CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...
CVE-2026-53455
CVE-2026-53455 is a command injection vulnerability in Blueprint Studio , a VS Code-like editor for Home Assistant configuration files. Prior to version 2.5.2 , the component custom_components/blueprint_studio/backend/git_manager.py generated a shell-based Git credential helper by interpolating t...
CVE-2026-53455 Blueprint Studio Git credential helper command injection
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...
CVE-2026-53455 Blueprint Studio Git credential helper command injection
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...
GHSA-3496-9G83-7V6X vulnerabilities
Vulnerabilities for packages: openstack-glance-2026.1-fips, airflow, airflow-postgres-fips, openstack-horizon-2026.1-fips, openstack-keystone-2025.1, openstack-glance-2025.2, apache-beam-python-3.14-sdk, openstack-keystone-2026.1-fips, mycli, openstack-placement-2025.2-fips,...
MONAI vulnerable to OS command injection
Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...
