34958 matches found
PT-2026-76672
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...
PT-2026-76794
Name of the Vulnerable Software and Affected Versions Tenda W20E version V16.01.0.62782 Description The '/goform/telnet' endpoint allows unauthenticated remote attackers to activate the Telnet daemon, which enables them to obtain root shell access to the device. Recommendations At the moment, the...
PT-2026-76723
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description In the glances/actions.py file, the GlancesActions.run function fails to respect the --disable-config-exec flag when processing on-alert action commands. This occurs because the function invokes secu...
CVE-2026-67966
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
PT-2026-73433
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
CVE-2026-67966
The Tenda W20E V5.0 router (firmware V16.01.0.6(2782)) exposes /goform/telnet, which unconditionally starts telnetd and opens port 23 to the WAN, granting an unauthenticated, passwordless root shell. The flaw stems from manufacturing-test code retained in production firmware. No fix is available;...
EUVD-2026-60538
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
PT-2026-76810
Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...
PT-2026-76719
Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...
[SECURITY] Fedora 44 Update: rust-pretty-git-prompt-0.2.2-11.fc44
Your current git repository information inside a beautiful shell prompt...
SJ-GPS-PRO-F11-Vulnerability
Independent vulnerability research on the SJRC F11 series consum...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055 Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-57062 vulnerabilities
Vulnerabilities for packages: gnupg...
Vim: Arbitrary Code Execution via Shell Keyword Lookup
...
PT-2026-73059
Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Connectwise Screenconnect
CVE-2024-1709 — ScreenConnect exploit chain Full exploit chai...
