USN-8857-1 kf6-kcoreaddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

USN-8857-1: KCoreAddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

CVE-2026-103265

Fleet versions before 4.89.0 are vulnerable to an information disclosure flaw in the commands/results endpoint. The root cause is a failure to properly filter MDM command results by team authorization. Consequently, team-scoped users can access MDM command results for hosts belonging to other tea...

CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

EUVD-2026-90659

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

BIT-MONGODB-2026-9737 Find command with $meta sort can lead to crash

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

BIT-OPENBAO-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-34190 CSRF in Alert Command Deletion

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-34190 CSRF in Alert Command Deletion

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-103489

In JetBrains YouTrack versions prior to 2026.2.19422 , an HTML injection vulnerability exists within VCS command failure notifications . This flaw allows for the improper neutralization of input during web page generation (CWE-79). While the vulnerability is present, no specific exploit details o...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103489

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

EUVD-2026-90580

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

CLEANSTART-2025-LU26051 Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution

Security vulnerability affects the exim package. Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution...

CLEANSTART-2024-RH47389 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata

Security vulnerability affects the exiv2 package. Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata...

CLEANSTART-2024-YC31676 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files

Security vulnerability affects the exiv2 package. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files...