EUVD-2026-55216

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55021

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

Linux Environment Variable Enumeration

Enumerates environment variables at the SYSTEM and USER scope on Linux. SYSTEM-scope variables are collected from /etc/environment, /etc/security/pamenv.conf, /usr/share/pam/security/pamenv.conf and shell scripts under /etc/profile.d/ plus /etc/profile and /etc/bashrc. USER-scope variables are...

MAL-2026-13666 Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

CVE-2026-19335

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

CVE-2026-19335 Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

CVE-2026-19279

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function loadpdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was inform...

GHSA-WHVH-WF3X-G77J vulnerabilities

Vulnerabilities for packages: tensorflow-cpu-jupyter...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

MAL-2026-13652 Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

metasploitable2-pentest-series

Metasploitable2 Penetration Testing Series A series of vulner...

CVE-2026-19245

CVE-2026-19245 affects HKUDS nanobot

CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

JLSEC-2026-1216 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy...

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed...

SUSE-SU-2026:3536-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...