CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...

CVE-2026-39987 — Updated!

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

OPENSUSE-SU-2026:21741-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

bitbang-cli v0.5.0

BitBang CLI bitbang is a single static binary remote-access multitool. From any browser: an interactive shell and file browser access to the remote machine. You can also reach web apps on that machine's network. Beyond the browser, it does TCP port forwarding, file copy, and terminal sharing. It...

...[ More ]

This Metasploit module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelps legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An...

BIT-GITLAB-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

openSUSE 16 Security Update : rav1e (openSUSE-SU-2026:21681-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21681-1 advisory. This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and...

openSUSE 16: gstreamer-devtools / gstreamer-devtools-devel / etc (openSUSE-SU-2026:21689-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21689-1 advisory. - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruptio...

SUSE-SU-2026:23441-1 Security update for cpio

This update for cpio fixes the following issues: Security issues fixed: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory...

USN-8704-1 cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

USN-8704-1: GNU cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars array with no upper boun...

Security update for rav1e (low)

openSUSE security update: security update for rav1e ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21681-1 Rating: low References: bsc1249016 Cross-References: CVE-2025-58160 CVSS scores: CVE-2025-58160 SUSE : 3.1...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3883 (ALAS-2026-3883)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3883 advisory. Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a...

OPENSUSE-SU-2026:21689-1 Security update for gstreamer-devtools

This update for gstreamer-devtools fixes the following issues: - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption bsc1243178. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI...

SUSE-SU-2026:23572-1 Security update for gstreamer-devtools

This update for gstreamer-devtools fixes the following issues: - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption bsc1243178. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI...

OPENSUSE-SU-2026:21681-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

SUSE-SU-2026:23567-1 Security update for rav1e

This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation bsc1249016. Changes for rav1e: - Update cargo dependencies...

OESA-2026-3540 cpio security update

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fixes: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio...