GitLab 17.0 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-104661)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

dlink

Iniezione di comandi e account backdoor nei dispositivi NAS D-Link Riepilogo della vulnerabilità: La vulnerabilità descritta interessa diversi dispositivi NAS D-Link, inclusi i modelli DNS-340L, DNS-320L, DNS-327L e DNS-325, tra gli altri. La vulnerabilità risiede nell'URI nassharing.cgi , che è...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

EUVD-2026-72558

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json...

CVE-2026-92924

The Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 is vulnerable to arbitrary WordPress shortcode execution. The root cause is a lack of authorization checks when rendering widget output, specifically via the get_addon_output_data function. Depending on the version, th...

EUVD-2026-91215

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

CVE-2026-92924: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the...

Linux Distros Unpatched Vulnerability : CVE-2026-102826

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

CVE-2026-92993

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-71538

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

CVE-2026-5059-poc

¿Dónde está CVE-2026-5059 en el código? La vulnerabilidad está en dos archivos que trabajan juntos: Archivo 1: tools.py — La causa raíz La versión antigua usaba shell=True en executepipedcommand: root@kitploit: CÓDIGO ANTIGUO VULNERABLE process = subprocess.run command, ← cadena sin procesar pasa...

CVE-2026-57136 PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

USN-8756-1 yelp vulnerability

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information...

Astra Linux – Vulnerability in Python-Click

This CVE record was assigned without following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit...

postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser

A flaw was found in PostgreSQL. An attacker with pgcreatesubscription rights can exploit a SQL injection vulnerability in the pgcreatesubscriber utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when pgcreatesubscriber is next run, leading to potential...

CVE-2026-82774

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82766

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-77250

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82794

SolarView Compact (by Contec ) contains an OS command injection vulnerability in its Schedule Settings feature. An attacker with authenticated access can execute arbitrary OS commands on the host system. The CVSS v3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indic...