conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

PT-2026-76719

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

CVE-2026-57062 vulnerabilities

Vulnerabilities for packages: gnupg...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

GO-2021-0227 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3467 vulnerabilities

Vulnerabilities for packages: gh...

GO-2026-5848 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GHSA-MXCG-P696-RM94

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

PT-2026-71628

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Multiple command and argument injection issues allow attackers to execute arbitrary commands by providing malicious input through various code paths. These paths include the RSYNC CONNECT PROG...

Vim < 9.2.0839 OS Command Injection (GHSA-r5v6-q6j8-8qw2)

The version of Vim installed on the remote host is prior to 9.2.0839. It is, therefore, affected by a vulnerability as referenced in the GHSA-r5v6-q6j8-8qw2 advisory. - The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled...

CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417

CVE-2026-17417 affects IBM i versions 7.3–7.6. It enables a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in Resource Monitoring and Control. CVSS 3.1 base score 8.8 (NETWORK/LOW, PRIVILEGES REQUIRED: LOW, USER INTERACTION: NONE...

EUVD-2026-57517

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

PT-2026-71271

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of shell metacharacters. This occurs when the system fails to properly filter or escape special characters...