CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437

The esengine DeepSeek-Reasonix (Reasonix Studio) desktop application contains an OS Command Injection vulnerability in the internal/gitcmd component. The root cause is the improper neutralization of special elements during the invocation of git diff filter.clean/smudge . A local attacker who can ...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

EUVD-2026-88734

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism...

CVE-2026-97420

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program modifies a system control sysctl parameter, the kernel fails to append a null-terminating byte to the replacement buffer. Downstream kernel parsers expecting a properly terminated string may read past...

CVE-2026-97418

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture subsystem within the ESS AudioDrive ES18xx sound card driver. During mixer initialization, the driver fails to verify whether memory allocation for sound control structures succeeds before dereferencing the returned...

CVE-2026-102473

A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as .....tar.gz consume excessive CPU...

CVE-2026-102474

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

CVE-2026-97589

A flaw was found in the Linux kernel's s390 cryptographic drivers. When handling asynchronous cryptographic operations, certain request callbacks incorrectly propagate error codes back to the crypto engine after already completing a request. This causes the crypto engine to mistakenly perform a...

EUVD-2026-88668

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

EUVD-2026-88667

A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as .....tar.gz consume excessive CPU...

CVE-2026-102473 Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled

A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as .....tar.gz consume excessive CPU...

CVE-2026-102473

A vulnerability exists in dash where the internal pmatch() matcher implements the * wildcard using unbounded recursion over candidate positions when built without libc fnmatch . A local user capable of providing filenames to the matcher can trigger super-polynomial backtracking by using short mul...

CVE-2026-86157

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-97584

A flaw was found in the Linux kernel's AFS Andrew File System subsystem. During server lookup operations, the candidate cleanup routine incorrectly frees memory associated with an existing server's endpoint state. A local user interacting with the filesystem could exploit this issue to trigger...

CVE-2026-86158

Progress Software Fiddler Everywhere 8.0.2 contains a vulnerability due to missing authentication in its local .NET backend (Fiddler.WebUi ). A local unauthenticated attacker can exploit unauthenticated localhost HTTP and SignalR RPC channels to mint OAuth tokens and read the machine-in-the-middl...

CVE-2026-86157

Progress Telerik Fiddler Everywhere versions prior to 8.2.0 are vulnerable to the exposure of privileged IPC functionality . A local, low-privileged attacker who can modify application launch parameters and influence a user to start the application can replace the UI or settings with attacker-con...

CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

EUVD-2026-88648

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...