USN-8856-1 kdenlive, mlt vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

USN-8856-1: Kdenlive, MLT vulnerability

It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties...

Important: Red Hat Security Advisory: pcp security update

An update for pcp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-103473: Improper Neutralization of Special Elements used in an OS Command

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-101880: Incorrect Authorization

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789464785)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789464785 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without...

CentOS Linux 8.5 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789464719)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789464719 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel (CENTOS7:CLSA-2026:1785244080)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1785244080 advisory. - FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surfac...

PT-2026-103515

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incorrect authorization issue exists in the system.run exec-approval policy. The ExecShellWrapperParser function fails to properly split commands on pipe operators or extract...

CVE-2026-101882: Incomplete List of Disallowed Inputs

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the...

CentOS Linux 8.5 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS8.5:CLSA-2026:1784799349)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784799349 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim...

Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via the rebase command handler and the trailer..cmd/trailer..command configuration keys, which allow an attacker to inject the...

EUVD-2026-89347

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-75926

A flaw was found in Hugo. This vulnerability enables arbitrary command execution by bypassing security restrictions designed to confine asset-processing tools. Because TailwindCSS is granted permission to create child processes by default, an attacker providing a malicious theme, module, or...

CVE-2026-100308

A flaw was found in GluonTS. The model loading component fails to safely handle untrusted data during deserialization, which can allow an attacker to execute arbitrary commands with the privileges of the running process. An attacker can exploit this issue by convincing a user or system to load a...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308

The Amazon GluonTS library is vulnerable to arbitrary command execution in versions prior to 0.17.0 . The root cause is the deserialization of untrusted data within the model loading component, which may allow context-dependent attackers to execute OS commands with the privileges of the loading p...