4116 matches found
PT-2026-78372
Name of the Vulnerable Software and Affected Versions Renovate versions 37.158.0 through 37.198.0 Description Command injection is possible in the helmv3 manager's handling of registryAliases. Attackers with commit access can manipulate registryAliases keys using unquoted shell metacharacters to...
CVE-2026-57062 vulnerabilities
Vulnerabilities for packages: gnupg...
CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...
GO-2021-0227 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2025-3467 vulnerabilities
Vulnerabilities for packages: gh...
GO-2026-5848 vulnerabilities
Vulnerabilities for packages: docker-machine-driver-harvester...
GHSA-MXCG-P696-RM94
creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...
CVE-2026-53790
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
PT-2026-71628
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC CONNECT PROG environment variable, daemon hooks, the rsync-ssl wrapper, and...
Vim < 9.2.0839 OS Command Injection (GHSA-r5v6-q6j8-8qw2)
The version of Vim installed on the remote host is prior to 9.2.0839. It is, therefore, affected by a vulnerability as referenced in the GHSA-r5v6-q6j8-8qw2 advisory. - The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled...
CVE-2026-17417
CVE-2026-17417 affects IBM i versions 7.3–7.6. It enables a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in Resource Monitoring and Control. CVSS 3.1 base score 8.8 (NETWORK/LOW, PRIVILEGES REQUIRED: LOW, USER INTERACTION: NONE...
CVE-2026-17417
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
EUVD-2026-57517
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
DrayTek - Remote Code Execution
DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...
PT-2026-71271
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of shell metacharacters. This occurs when the system fails to properly filter or escape special characters...
UBUNTU-CVE-2026-5917
libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as...