CLSA-2026-1773222843 python3: Fix of 2 CVEs

CVE-2025-15366: reject control characters in IMAP commands - CVE-2026-1299: email: verify headers are sound in BytesGenerator...

Malicious code in anontest123 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f4d47757d3ee2d0dde7ed82934a06bf64343c344a7b090cf77f05dcd73f813a5 Installing the package starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2026-25041

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values database name, host, password, etc. without proper sanitization. The password and other...

EUVD-2026-11087

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands...

EUVD-2026-11077

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

EUVD-2026-11088

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands...

CVE-2026-20892

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands...

CVE-2026-23815

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands...

CVE-2026-23816 Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-23816 Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

Summary Multiple Git-related API endpoints use execAsync with string interpolation of user-controlled parameters file, branch, message, commit, allowing authenticated attackers to execute arbitrary OS commands. Details The claudecodeui application provides Git integration through various API...

SUSE CVE-2026-26982

Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 Ctrl+C in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop...

PT-2026-24570

Name of the Vulnerable Software and Affected Versions AOS-CX Switches affected versions not specified Description A flaw exists in a custom binary within the AOS-CX Switches' Command Line Interface CLI. A remotely authenticated attacker with high privileges can exploit this issue to inject...

xygeni-action 安全漏洞

Oxyni-action is a GitHub code security scanning workflow plugin developed by Xygeni. Oxyni-action has a security vulnerability that stems from tag poisoning, which can lead to supply chain attacks, allowing attackers to execute arbitrary commands on the CI runner...

HPE AOS-CX 安全漏洞

HPE AOS-CX is a network operating system developed by Hewlett-Packard Enterprise HPE for data centers, campuses, and edge locations. It is designed to provide flexible and innovative network services while enhancing network performance. HPE AOS-CX contains a security vulnerability, which stems fr...

CVE-2026-23816: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-20892: Improper Control of Generation of Code

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands...

Cursor 操作系统命令注入漏洞

Cursor is an AI-powered intelligent code editor developed by Cursor Open Source. Prior to Cursor 2.0, there was a vulnerability related to operating system command injection. This vulnerability stemmed from the possibility of the model executing malicious instructions, which could lead to automat...

PT-2026-24571

Name of the Vulnerable Software and Affected Versions AOS-CX Switches affected versions not specified Description A flaw exists in the command line interface of AOS-CX Switches that could allow a remote attacker with valid credentials to execute arbitrary commands on the operating system...

Comtrend AR-5310 安全漏洞

The Comtrend AR-5310 is a wireless router device produced by the Comtrend company in the United States. The Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k version contains a security vulnerability. This vulnerability stems from command substitution bypasses in the restricted shell, which may...