AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1774518355)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1774518355 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects command...

RHEL 8 : pcp (RHSA-2026:73767)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73767 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

CentOS Linux 8.5 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1779583625)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779583625 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777660095)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777660095 advisory. - Mitgation of CVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be bypassed for certain browser types...

CVE-2026-102911: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wikicapturesource MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794

The Ziroom ZHOME A0101 1.0.1.0 is vulnerable to a command injection flaw due to improper processing of the url argument within the /api/ZRnetwork/ping file. This vulnerability allows for remote attack execution. While the exploit has been disclosed to the public and may be used, the vendor has no...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102792

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-102793

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_time_zone function within the /api/ZRFirmware/set_time_zone file. An attacker can achieve remote command execution by manipulating the hostname/zonename argument. The documents indicate...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102792

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_syslog function within the /api/ZRnetwork/set_syslog file. By manipulating the conloglevel or log_size arguments, a remote attacker can execute arbitrary commands. The documents confirm...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via path interpolation in the generated activate.sh bash and activate.fish fish activation scripts. When a virtualenv is created with a path containing shell metacharacters, those characters are embedded unquoted into...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the BatchActivator.quote method in src/virtualenv/activation/batch/init.py, which previously returned its input string unchanged. When a virtualenv is created in a path containing cmd.exe operator characters such a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

DEBIAN-CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...