4285 matches found
CVE-2026-57169
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
CVE-2026-57169
The Docker management application Dockhand is vulnerable to unauthenticated command execution in versions prior to 1.0.34 . The /api/containers/exec endpoint fails to enforce authentication during a WebSocket upgrade request. An unauthenticated attacker with network reach and knowledge of a targe...
CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...
PT-2026-115656
Name of the Vulnerable Software and Affected Versions Dockhand versions prior to 1.0.34 Description The in-browser container terminal endpoint '/api/containers//exec' fails to enforce authentication during the WebSocket upgrade request. An unauthenticated attacker with network access and knowledg...
RHEL 9 : kernel (RHSA-2026:83738)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83738 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: exec: Cleanup POSIX timers right after...
Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500394)
The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500394 advisory. - mm/pagewalk: fix stale walk-action escaping walkpmdrange Hyunwoo Kim Orabug: 40157478 CVE-2026-89754 - exec: Cleanup POSIX timers right after...
RHEL 9 : kernel (RHSA-2026:83775)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83775 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: exec: Cleanup POSIX timers right after...
Astra Linux – Vulnerability in exim4
Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere, because rdainterpret uses a privileged pipe without the closeonexec flag...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: exec: Fix for the issue involving the comparison between permission checks and setuid/gid usage When opening a file for execution using dofilpopen, permission checks are performed based on the file’s metadata at that moment. If t...
SUSE CVE-2026-110925
CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...
CVE-2026-98388
A flaw was found in the Linux kernel. During program execution, the kernel closes file descriptors marked for close-on-exec while holding an internal process state lock. If closing a file descriptor stalls on an unresponsive or user-space filesystem, the lock remains held and blocks related syste...
PYSEC-2026-4254 PraisonAI: Shell command allowlist bypass via find -exec built-in action
Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...
PYSEC-2026-4236 Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...
CVE-2026-110925
Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...
CVE-2026-110925
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...
CVE-2026-110925
Removed by vendor...
CVE-2026-110925
...
EUVD-2026-101836
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...