Linux Distros Unpatched Vulnerability : CVE-2026-94106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

RHEL 9 : libxml2 (RHSA-2026:70639)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70639 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

CVE-2026-50187

A flaw was found in the dotenv plugin of Oh My Zsh. A remote attacker could craft a malicious .env file containing arbitrary shell commands. When a user changes into a directory containing this file, the dotenv plugin processes it, leading to the execution of these commands with the user's...

CVE-2026-76802

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator...

CVE-2026-76802

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its DAST template loading branch. When the -dast flag is enabled, the loader fails to enforce cryptographic signature checks on templates containing both a fuzzing: block and an unsigned code: block. This allows ...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

CVE-2011-2523 — vsftpd 2.3.4 Backdoor Exploit !Pythonhttps...

CVE-2026-80151

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

CVE-2026-80144

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented...

CVE-2026-80143

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented...

CVE-2026-80151 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

EUVD-2026-84509

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by...

PT-2026-96799

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.2 SLC9000 versions prior to 9.7.0.2 EMG8500 versions prior to 9.7.0.1 EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions no...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in sshconfig...

Insufficient input sanitization of shell metacharacters in Brocade SANnav

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...

CVE-2026-80152: Improper Neutralization of Special Elements used in an OS Command

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

PT-2026-97040

pfBlockerNG flaw CVE-2026-78902: DNS request stores XSS in logs. Admin views Stats page, malicious JS executes, CSRF token stolen, reverse shell launched as root. Netgate patched in 24 hours. Update now. Pentesting CyberSecurity https://t.co/kZZEiHnlXh https://t.co/l4r0DsVKk7...

Check Point Security Management R82.20 Compromise Checks

These shell scripts check Check Point Security Management logs and temporary directories for indicators associated with CVE-2026-93616...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: texlive-base (UTSA-2023-002148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002148 advisory. LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua le...