CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-73623

A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...

CVE-2026-19628: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

CVE-2026-19682: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

CVE-2026-19884: Inclusion of Functionality from Untrusted Control Sphere

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

Linux Distros Unpatched Vulnerability : CVE-2026-73623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command executio...

...[ More ]

A proof of concept exploit for an unauthenticated remote code execution vulnerability in the Fabrik Joomla component versions prior to 4.6.8. A request-controlled filter eval flag can cause an attacker-supplied filter value to be passed to PHP eval, allowing arbitrary PHP and ultimately shell...

CVE-2026-19681: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

CVE-2026-46439: Improper Control of Generation of Code

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

PT-2026-72080

Name of the Vulnerable Software and Affected Versions Security Center affected versions not specified Description A command injection flaw allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system. These commands are executed with the privileges of...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

EUVD-2026-58540

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...

CVE-2026-73664

The CVE-2026-73664 issue affects FreePBX (Open Source IP PBX) and concerns the publicKeySave AJAX endpoint in Backup.class.php, vulnerable from 17.0.5.34 through 17.0.11. It accepts an authenticated administrator’s SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the aster...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

ALPINE-CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

EUVD-2026-58069

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...