CVE-2026-65108

Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable...

UBUNTU-CVE-2026-65108

Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable...

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

dotenv-diff [email protected]

dotenv-diff Scan your codebase to detect every environment variable reference. It helps you catch missing, unused, duplicated, and misused variables early, before they cause runtime errors. First class support for SvelteKit, Next.js, and Nuxt. Also works well in modern JavaScript/TypeScript...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

CVE-2026-84675

The Jenkins TICS Plugin versions 2025.1.1 and earlier are vulnerable to an OS command injection flaw. The root cause is the failure to correctly escape build environment variable values when constructing OS commands. An attacker capable of controlling these environment variable values can execute...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

EUVD-2026-70148

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

Security Bulletin: IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution

Summary IBM ContextForge MCP Gateway allows authenticated users with developer privileges to supply a jq program in the tool jsonpathfilter field that executes unrestricted built-in such as $ENV inside the server process, exposing environment variables including cryptographic keys and database...

Security Bulletin: IBM ContextForge Translate is affected by cross-client credential context confusion

Summary IBM ContextForge Translate utility contains a credential context confusion vulnerability in the Translate service mcpgateway/translate.py when the --enable-dynamic-env opt-in flag is active. The Translate service is a standalone component within the IBM ContextForge codebase that bridges...

CVE-2026-84694

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

CVE-2026-84694 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

CVE-2026-84694

Coolify versions before 4.2.0 are affected by a remote code execution vulnerability caused by improper escaping of environment variable key names in Docker commands executed over SSH on managed servers. An authenticated attacker can inject shell metacharacters into environment variable keys, allo...

CVE-2026-84694 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

CVE-2026-84694 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

EUVD-2026-69785

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

PT-2026-84798

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

CVE-2026-84675: Improper Neutralization of Special Elements used in an OS Command

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...