CVE-2024-4577

CVE-2024-4577 نظرة عامة CVE-2024-4577 هي ثغرة أمنية تؤثر على خوادم PHP في الإصدارات التالية: PHP 8.3.x 8.3.8 والإصدارات الأقدم PHP 8.2.x 8.2.20 والإصدارات الأقدم PHP 8.1.x 8.1.29 والإصدارات الأقدم جميع الإصدارات السابقة للإصدار 8.0 الإصدارات غير المدعومة 7.x و5.x هذه الثغرة هي خلل في تنفيذ...

CVE-2026-3854-PoC

PoC CVE-2026-3854 — RCE sur GitHub via l'injection d'options push X-Stat Uniquement à des fins de recherche en sécurité éducative et autorisée. Ne pas utiliser contre un système sans autorisation écrite explicite. Aperçu CVE-2026-3854 est une vulnérabilité d'exécution de code à distance RCE dans ...

dhcpoptinj

DHCP विकल्प इंजेक्टर क्या आपने कभी DHCP अनुरोधों को इंटरसेप्ट करके उनमें प्रेषक को पता न चले कुछ अतिरिक्त DHCP विकल्प घुसाने की इच्छा की है? शायद नहीं। फिर भी, यदि कभी ऐसी आवश्यकता उत्पन्न हो, तो dhcpoptinj उम्मीद है आपकी मदद करेगा। क्यों DHCP अनुरोधों में हेरफेर करने के कई कारण हो सकते हैं,...

EUVD-2026-65525

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers incomplete fix of CVE-2026-12841...

ghe-push-option-rce-scanner

CVE-2026-3854 — RCE su GitHub Enterprise Server tramite Push Option Injection Panoramica Neutralizzazione impropria dei valori delle opzioni push in GHE. Un attaccante con accesso push ottiene RCE sull'istanza. Campo| Valore ---|--- CVE| CVE-2026-3854 Gravità| CRITICA Prodotto| GitHub Enterprise...

CVE-2026-81529

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...

EUVD-2026-67213

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...

CVE-2026-76219

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

PT-2026-82743

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of delimiters during connection-URL construction enables connection-option injection. This occurs when an application passes untrusted text into the driver's...

EUVD-2026-66601

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

Linux Distros Unpatched Vulnerability : CVE-2026-79675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM...

CVE-2026-77585 Improper Validation of SSH Target in Okta Privileged Access Client

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...

CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

PT-2026-81356

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Insufficient validation of JVM options passed through the options parameter in the java function allows the injection of dangerous JVM flags. By supplying malicious options such as -agentpath,...

CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...

UBUNTU-CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...