CVE-2026-67623 Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook...

CVE-2026-71284

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71243

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

EUVD-2026-53316

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

The vulnerabilities of the functions Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame() in the Python library for interacting with Git repositories, GitPython, allow attackers to execute arbitrary commands and overwrite arbitrary files.

The vulnerabilities of the functions Repo.archive, git.lsremote, Repo.itercommits, and Repo.blame in the GitPython library for interacting with Git repositories are related to the lack of data cleaning at the control level. Exploiting these vulnerabilities could allow an attacker to execute...

CVE-2026-17625: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...

CVE-2026-13477: Improper Neutralization of Special Elements used in an OS Command

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

RHEL 9 : sg3_utils (RHSA-2026:50141)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50141 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

CVE-2026-67324

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

perl-GD: perl-GD: Arbitrary command execution and file overwrite via crafted filenames

A flaw was found in perl-GD. A remote attacker could exploit this vulnerability by providing specially crafted filenames to functions that open files. This issue arises because the makefilehandle function uses Perl's 2-argument open with untrusted input, allowing special characters like pipes or...

RHEL 7 : perl-GD (RHSA-2026:49758)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:49758 advisory. This is a autoloadable interface module for GD, a popular library for creating and manipulating PNG files. With this library you can create PNG imag...

CVE-2026-67323: Improper Neutralization of Special Elements used in a Command

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-17347

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

EUVD-2026-51516

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution...

PT-2026-66742

Name of the Vulnerable Software and Affected Versions Hikvision Wireless Access Points affected versions not specified Description Some networking products are susceptible to authenticated command execution resulting from insufficient input validation. An attacker possessing valid credentials can...

CVE-2026-16843: Improper Neutralization of Special Elements used in an OS Command

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution...