CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data—such as API tokens,...

CVE-2026-114107

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

EUVD-2026-106910

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CLSA-2026-1792442514 cifs-utils: Fix of CVE-2022-27239

CVE-2020-14342: mount.cifs shell command injection via username mount option when built with systemd-ask-password support...

CLSA-2026-1792442320 cifs-utils: Fix of CVE-2022-27239

CVE-2020-14342: mount.cifs shell command injection via username mount option when built with systemd-ask-password support...

MAL-2026-17907 Malicious code in @beloved-lenora/opencode-shell-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8dd8daa41992a2f1dec185b6924f6cc81b7172b55cccd6930f062317984ba8 The package presents itself as a safety guard that reviews shell commands before execution, but contains an undocumented branch that activates when t...

CVE-2026-111451

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

EUVD-2026-102604

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

MiracleLinux 8 : emacs-26.1-15.el8_10.2 (AXSA:2026-2066:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2066:02 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the...

CLSA-2026-1792080478 emacs: Fix of 3 CVEs

CVE-2026-77219: fix integer overflow in PBM image loader - CVE-2026-79992: restrict Tramp user names to prevent shell command injection - CVE-2026-108976: strengthen Tramp user and host name validation...

EUVD-2026-101275

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --doc...

CVE-2026-110634

The git-diff library (versions before 2.0.7 ) is vulnerable to OS Command Injection via the gitDiff API . The root cause is that the library fails to properly neutralize special characters in diffed document strings, allowing attackers to embed $(cmd) or backtick substitutions . These substitutio...

Shell command bypass Windows

The vulnerability of the Shell command shell in Windows operating systems is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to bypass existing security mechanisms...

Rocky Linux 8 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_80506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...

CVE-2026-110202

Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...

emacs security update

An update is available for emacs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNU Emacs is a powerful, customizable, self-documenting text editor. It provide...

RLSA-2026:80507 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

emacs security update

An update is available for emacs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNU Emacs is a powerful, customizable, self-documenting text editor. It provide...

RLSA-2026:80506 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Important: Red Hat Security Advisory: emacs security update

An update for emacs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...