PT-2026-78650

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.75 Description An authenticated user with attachment upload privileges can execute arbitrary commands as the Wekan server process on deployments where an external scanner is configured. The issue occurs in...

PT-2026-78372

Name of the Vulnerable Software and Affected Versions Renovate versions 37.158.0 through 37.198.0 Description Command injection is possible in the helmv3 manager's handling of registryAliases. Attackers with commit access can manipulate registryAliases keys using unquoted shell metacharacters to...

PT-2026-78363

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

PT-2026-78624

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A shell metacharacter injection flaw allows a local attacker to execute arbitrary commands on the system. Recommendations At the moment, there is no information...

Linux Distros Unpatched Vulnerability : CVE-2026-68939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv- version-file-read accepts shell glob metacharacters in...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

Linux Distros Unpatched Vulnerability : CVE-2026-74965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

VulnCheck KEV: CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-52817

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

CVE-2026-52817

In Linuxfabrik Monitoring Plugins prior to 5.1.0, the Debian.sudoers file allowed the nagios/icinga account to run /usr/bin/apt-get as root with unrestricted arguments. An attacker with the monitoring account can execute sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh" to obtain a root ...

CVE-2026-53455

CVE-2026-53455 is a command injection vulnerability in Blueprint Studio , a VS Code-like editor for Home Assistant configuration files. Prior to version 2.5.2 , the component custom_components/blueprint_studio/backend/git_manager.py generated a shell-based Git credential helper by interpolating t...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

MONAI vulnerable to OS command injection

Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...

CVE-2026-74965

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Shell Integration component...

CVE-2026-75857

CodeWhale versions = 0.8.41 and 0.8.64 contain a vulnerability in the execshellinteract alias execinteract tool, whose approvalrequirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an...

CVE-2026-75911

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-75911

CodeWhale before version 0.8.64 fails to validate the allow_shell parameter in .codewhale/config.toml, letting attackers commit a malicious config that grants the AI model exec_shell and task_shell tools upon repository open, enabling arbitrary shell command execution on the victim's machine. Fix...