CVE-2021-22205

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Vuln Product Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...

CVE-2026-77474

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

EUVD-2026-102919

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474

The destructive_command_guard (dcg) tool (prior to version 0.6.6 ) is vulnerable to an exponential-time command-substitution preprocessing flaw. The issue occurs because nested or unclosed substitutions (e.g., $( or $(() cause the scanner to recursively rescans the remaining command suffix. This ...

CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-of-concept scanner and exploit helper for CVE-2026-14378 : unauthenticated administrator session takeover in the WordPress plugin DevKit Pro dplugins through a flawed user-switch “revert” flow. Legal: Use only on systems you own or have...

Perfusion

Perfusion On Windows 7 , Windows Server 2008R2 , Windows 8 , and Windows Server 2012 , the registry key of the RpcEptMapper and DnsCache 7/2008R2 only services is configured with weak permissions. Any local user can create a Performance subkey and then leverage the Windows Performance Counters to...

react2shell-evolved

React2Shell Scanner High Fidelity Detection for RSC/Next.js RCE Scanner for detecting Remote Code Execution RCE vulnerabilities in React Server Components and Next.js applications. About React2Shell Scanner is a specialized tool for identifying Remote Code Execution RCE vulnerabilities in...

nginx-ui-CVE-2026-42221-CVE-2026-42238-

nginx-ui CVE Verification Environment This repository is for actually verifying two CVEs reported for nginx-ui Nginx's Web GUI management tool in a Docker environment. CVE-2026-42221 : Unauthenticated administrator account takeover CVE-2026-42238 : Command execution via unauthenticated backup...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 Vulnerability Environment Setup and CTF Challenge Design Project Overview This project includes dual-track security research implementations: 1. Traditional Vulhub Environment Setup : Leveraging the open-source Vulhub vulnerability database to quickly reproduce the...

MAL-2026-17866 Malicious code in pyyi (PyPI)

The verified PyPI wheel declares a console command named python2 pyyi.cli:main. For commands other than the local REPL, help, version, unlock, or uninstall paths, it obtains configuration and calls runpayload. Registration sends the hostname and OS to a configured space-z.ai server and stores the...

Malicious code in pyyi (PyPI)

The verified PyPI wheel declares a console command named python2 pyyi.cli:main. For commands other than the local REPL, help, version, unlock, or uninstall paths, it obtains configuration and calls runpayload. Registration sends the hostname and OS to a configured space-z.ai server and stores the...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263

The SparkyFitness health and fitness tracker is vulnerable to OS command injection in versions prior to 1.6.0 . The flaw exists in the api/admin/backup/restore endpoint, where the application interpolates an uploaded filename directly into a shell command. An authenticated global administrator ca...

CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

EUVD-2026-102913

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

Security Bulletin: IBM Cognos Analytics is affected by security vulnerabilities across multiple versions of the product

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Cognos Analytics in all supported application versions. This Security Bulletin addresses the affected versions and the remediation versions which contain the fixes. Please note that certain CVEs are...