Security update for libxml2

This update for libxml2 fixes the following issue CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:3097-1 Security update for libxml2

This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

Security update for libxml2

This update for libxml2 fixes the following issue CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:3096-1 Security update for libxml2

This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

Security update for libxml2

This update for libxml2 fixes the following issue CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:3095-1 Security update for libxml2

This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

CVE-2026-58317

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

CVE-2026-58317

The vulnerability CVE-2026-58317 affects the TTSSH2 plugin used by Tera Term. It is described as an Unsigned to Signed Conversion Error (CWE-196) that can occur when Tera Term connects to a server controlled by an attacker. The issue may trigger an out-of-bounds read/write, potentially causing ad...

EUVD-2026-45140

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

EUVD-2026-45139

Improper Handling of Length Parameter Inconsistency CWE-130 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of...

PT-2026-60838

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

GHSA-WG4W-WR5Q-6VJC Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via incomplete sanitization of user-supplied commands in the terminal process. An attacker can execute arbitrary operating system commands as the web server user by injecting shell metacharacters such as single pipe |,...

GHSA-9643-6XJP-VX57 Pheditor has an authenticated terminal command whitelist bypass

Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...

Pheditor has an authenticated terminal command whitelist bypass

Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...

CVE-2026-46515

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERMREAD access was sufficient to call fmlistmanagers, fmlistpinsets, fmshowcontext, fmgetmcpconfig, fmbackupstatus, fmwhoscalling, fmrunsavedquery, and fmdiagnosetrunk, exposing AMI manager secrets, outbound dial PIN...

Malicious code in @ai-support-agent/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69 The @ai-support-agent/cli package installs a long-running daemon ai-support-agent start that connects to a vendor API default...

MAL-2026-10707 Malicious code in @ai-support-agent/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69 The @ai-support-agent/cli package installs a long-running daemon ai-support-agent start that connects to a vendor API default...

MAL-2026-10708 Malicious code in @aicommander/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell...