RHEL 10 : pcp (RHSA-2026:72273)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72273 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

PT-2026-108120

grep search Command Injection via Unescaped $ Shell Substitution CWE-78 Summary The grep search tool in code-ollama constructs a shell command string by interpolating attacker-controlled pattern and path arguments, then executes it via child process.exec. The sanitization only escapes backslashes...

Exploit for CVE-2026-71963

CVE-2026-71963 — Hermes Agent RCE via a repository-delivered...

CVE-2026-101045 Fleet Homebrew Cask OS Command Injection via Metadata

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters for exampl...

CVE-2026-101045 Fleet Homebrew Cask OS Command Injection via Metadata

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters for exampl...

CVE-2026-101045

Fleet-maintained app install and uninstall scripts for macOS are vulnerable to OS command injection due to insufficient escaping of Homebrew cask metadata . In manifests generated before 2026-08-19 , certain interpolation sites failed to escape shell metacharacters (e.g., $(...)), allowing an att...

Exploit for CVE-2026-100382

CVE-2026-100382 - MediaWiki ExternalData extension OS command...

CVE-2026-101032

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032

The navi tool (versions through 2.24.0 ) is vulnerable to OS Command Injection due to a failure to properly escape cheatsheet variable values during shell command substitution. An attacker can achieve arbitrary command execution with victim privileges by injecting shell metacharacters through cra...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

segmented-pentest-lab

Segmented Pentest Lab A self-built, Docker-based segmented ne...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the process.run function during Liquidsoap configuration generation for live recording. An attacker can execute arbitrary system commands by supplying a specially crafted streamer username containing shell...

CVE-2026-100852

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...