Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

ALSA-2026:80507 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

ALSA-2026:80506 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

RHEL 9 : emacs (RHSA-2026:80507)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80507 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp,...

CVE-2026-108593

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-101947: Improper Neutralization of Special Elements used in an OS Command

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

RHEL 8 : libxml2 (RHSA-2026:79119)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79119 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

PraisonAI: Shell command allowlist bypass via find -exec built-in action

Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2mjm-h6qj utility-tools shell chaining and GHSA-vjv9-7m7j-h833 SandboxExecutor chaining can be bypassed via find's built-in -exec action. The fix blocks shell metacharacters ;|& + The ...

Low: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability...

PT-2026-107811

Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...

[SECURITY] [DSA 6548-1] node-shell-quote security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...

CVE-2026-105793

The Microsoft UFO open-source framework is vulnerable to an authenticated Android shell command injection in the press_key tool within ufo/client/mcp/http_servers/mobile_mcp_server.py prior to version 3.0.9 . The root cause is the handling of a free-form key_code parameter, which is passed to adb...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105788

The Microsoft UFO open-source framework is vulnerable to authenticated Android shell command injection in versions prior to 3.0.10 . The flaw exists in the type_text and launch_app tools within ufo/client/mcp/http_servers/mobile_mcp_server.py, where the text and package_name parameters are passed...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-102828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

@nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...