GHSA-22JQ-VG5J-6VGG vulnerabilities

Vulnerabilities for packages: pulumi, opensearch-dashboards-fips, langfuse, npm, sqlpad, renovate, actions-runner, lerna, librechat, code-server, kubeflow-pipelines, unleash-proxy, wazuh-dashboard, unleash-fips, unleash, saf, graalvm, kibana, opensearch-dashboards, prism, wazuh-dashboard-fips,...

CVE-2026-16791

A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges...

CVE-2026-16793

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...

CVE-2026-16793

The CVE-2026-16793 issue affects Lenovo XClarity Orchestrator (LXCO) 2.2.0, where improper neutralization of special elements in an OS command could allow an authenticated attacker to execute arbitrary OS commands as a privileged user under a specific circumstance. The advisory lists high impact ...

EUVD-2026-52886

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...

CVE-2026-16793 Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...

CVE-2026-16793

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...

CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

EUVD-2026-52636

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

Improper Neutralization of Input Used for LLM Prompting

Overview strands-agents-tools is an A collection of specialized tools for Strands Agents Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting via the shell tool. An attacker can execute arbitrary operating system commands by crafting a prompt...

PT-2026-67677

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

Photon OS 5.0: Linux PHSA-2026-5.0-0935

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0935. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Important Photon OS Security Update - PHSA-2026-5.0-92-0939

Updates of 'python3-tornado' packages of Photon OS have been released...

Mozilla Firefox < 153.0.3

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 153.0.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-73 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system, related to insufficient input data validation, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of software products for conducting Zoom Workplace video conferences on the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-69255: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

Photon OS 5.0: Nginx PHSA-2026-5.0-0935

An update of the nginx package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0935. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

CVE-2026-18641 Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...