Exploit for CVE-2026-61732

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab...

PT-2026-98890

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description In the 'admin/themes standard pages.php' endpoint, the application validates uploaded logo content by MIME type but uses the attacker-controlled std pgs logo extension when creating the stored...

PT-2026-99117

Name of the Vulnerable Software and Affected Versions CliInvoke versions 2.0.0 through 2.8.4 CliInvoke versions 2.9.0 through 2.9.3 CliInvoke versions 2.10.0 through 2.10.4 CliInvoke versions 3.0.0-alpha.1 through 3.0.0-beta.1 AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0 Descripti...

CVE-2026-100369: Improper Neutralization of Argument Delimiters in a Command

CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for invoking command-line programs and wrapping executable processes. CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as...

CVE-2026-95832: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...

CVE-2026-85542: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

PT-2026-98859

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated attacker can exploit a command injection flaw in the GIM bundle import functionality. By providing a specially crafted GIM bundle, an attacker can pass controlled arguments...

PT-2026-98841

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color control in kitty/window.py...

CVE-2026-42322: Unrestricted Upload of File with Dangerous Type

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

The vulnerability of the libssh library, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the libssh library is related to the lack of measures taken to clean data at the administrative level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

The vulnerability of the RDP client FreeRDP, related to the introduction or modification of arguments, allows attackers to execute arbitrary commands.

The vulnerability of the RDP client FreeRDP is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

The vulnerability of the Python library for interacting with Git repositories, GitPython, relates to the implementation or modification of arguments, allowing attackers to execute arbitrary commands.

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the functions responsible for generating command lines for the virsh file in the glances/plugins/vms/engines/virsh.py module of the Glances monitoring tool allows a attacker to execute arbitrary commands.

The vulnerability of the virsh function in the Glances/plugins/vms/engines/virsh.py module of the monitoring tool Glances is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the secure_popen() function in the Glances monitoring tool glances/secure.py allows a attacker to execute arbitrary commands.

The vulnerability of the securepopen function in the Glances monitoring tool glances/secure.py is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

The vulnerability of the Python library for interacting with git repositories, GitPython, arises from the possibility of introducing or modifying arguments, allowing attackers to execute arbitrary commands.

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the BuildKit container-building software lies in the ability to introduce or modify arguments, allowing a malicious actor to execute arbitrary commands.

The vulnerability of the BuildKit container-building software lies in the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-95832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....

Linux Distros Unpatched Vulnerability : CVE-2026-95521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to...

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions. The wrappers re-run a caller-supplie...