CVE-2026-35020

This CVE ID has been rejected by the its CVE Numbering Authority CNA. It was determined that the attack requires an attacker to already control arbitrary environment variables, a level of access they consider functionally equivalent to code execution and outside the threat model of CLI tools...

CVE-2026-5677 Totolink A7100RU cstecgi.cgi CsteSystem os command injection

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been...

Exploit for Classic Buffer Overflow in Apple Ipados

⚠️ CVE-2026-28858 — Buffer Overflow en Apple iOS/iPadOS ╔...

CVE-2026-35175

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15...

GO-2026-4920 KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai

KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai...

CVE-2026-34982 Vim modeline bypass via various options affects Vim < 9.2.0276

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the PMLE flag, allowing a modeline to be executed...

CVE-2026-5663 OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible...

Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps

Your attack surface no longer lives on one operating system, and neither do the campaigns targeting it. In enterprise environments, attackers move across Windows endpoints, executive MacBooks, Linux infrastructure, and mobile devices, taking advantage of the fact that many SOC workflows are still...

MAL-2026-2500 Malicious code in totally-safe-util (npm)

Multiple suspicious behaviors: postinstall script, hex obfuscation, OS command execution to open a Rickroll, and attempt to hide execution. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d45a8a1395a8ff66e2ea74cacd9d8de0ebaa9e88e0170a6907b3e4861a2acc5 The packa...

CVE-2026-5619 Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection

A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarizecommand. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access...

The vulnerability of the iTunes Store component for iPadOS and iOS operating systems allows a hacker to circumvent existing security restrictions.

The vulnerability of the iTunes Store component for iPadOS and iOS is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...

The vulnerability of PackageKit for macOS operating systems, which allows a hacker to increase their privileges

The vulnerability of PackageKit for macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of operating systems iPadOS and iOS, as well as macOS, is related to the disclosure of information through registration files, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of iPadOS and iOS operating systems, as well as macOS, involve the exploitation of registration files for information disclosure. Exploiting these vulnerabilities can allow attackers to gain unauthorized access to protected information...

The vulnerability of the Messages component in macOS operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the Messages component in macOS operating systems is related to insecure temporary files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the configd daemon in operating systems running macOS, which allows a perpetrator to compromise the accessibility of protected information

The vulnerability of the configd daemon in macOS operating systems is related to integer overflow. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected information...

The vulnerability of the AppleEvents component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AppleEvents component in macOS operating systems is related to state management errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of iPadOS and iOS operating systems, related to the operation beyond the memory buffer, allows attackers to trigger a service failure.

The vulnerability of iPadOS and iOS operating systems lies in the fact that operations occur outside of the memory buffer. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of AppleScript components in macOS operating systems allows attackers to compromise the integrity of protected information.

The vulnerability of AppleScript components in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...

The vulnerability of the libxpc library in macOS operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the libxpc library in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the AppleKeyStore component in operating systems such as visionOS, iOS, iPadOS, macOS, watchOS, and tvOS allows a perpetrator to trigger a service failure.

The vulnerability of the AppleKeyStore component in operating systems such as visionOS, iOS, iPadOS, macOS, watchOS, and tvOS relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a malicious individual to cause a service failure...