ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

CVE-2026-24061

CVE-2026-24061 - Telnet Argument Injection Nuclei template for detecting the CVE-2026-24061 vulnerability in GNU inetutils telnetd, allowing root access without authentication. 📋 Vulnerability Description CVE-2026-24061 is a critical argument injection vulnerability in GNU inetutils telnetd that...

CVE-2026-25130-Cybersecurity-AI-CAI-Framework-0.5.10

CVE-2026-25130 – 网络安全AI（CAI）框架参数注入 / 操作系统命令注入 PoC 作者：Mohammed Idrees Banyamer 国家：约旦 GitHub：https://github.com/yourusername Instagram：@banyamersecurity 概述 本仓库包含一个概念验证（PoC），演示了网络安全AI（CAI）框架中导致操作系统命令注入的参数注入漏洞。 该问题存在于 findfile 工具中，用户可控输入被不安全地传递给底层系统命令，从而允许任意命令执行。 CVE ID：CVE-2026-25130 漏洞类型：参数注入 →...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

EUVD-2026-75097

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CVE-2026-8044 is a CWE-88 (Argument Injection) vulnerability in Schneider Electric software, enabling remote code execution when a privileged attacker supplies malicious arguments as backup configuration parameters . The CVSS 4.0 score is 8.6 (HIGH) , with low attack complexity and no user intera...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-24061

CVE-2026-24061 GNU Inetutils telnetd Remote Authentication Bypass Seriously, telnet in 2026? Come on guys, it's time to move on. SSH exists since 1995. 🤦 Description A critical authentication bypass vulnerability in GNU Inetutils telnetd affecting versions 1.9.3 through 2.7. The vulnerability...

apache-camel-docling-security-assessment

CVE-2026-40047 - Apache Camel Docling CLI Argument Injection Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache Camel Docling argument validation risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot...

CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87794

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

EUVD-2026-74790

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

CVE-2026-87794

bestzip (Node.js package node-bestzip) versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function. Attackers can inject arbitrary arguments to the Info-ZIP backend by supplying a malicious destination path combined with crafted source entries, leading to arbitr...

CVE-2026-87794 bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands...

CVE-2024-4577

CVE-2024-4577 Argument injection vulnerability in PHP INSTALL git clone https://github.com/didarul342/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt USAGE root@kitploit: Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets python3...

CVE-2026-24061

CVE-2026-24061：GNU InetUtils telnetd 认证绕过 - 深度分析 执行摘要 CVE-2026-24061 是 GNU InetUtils telnetd 中的一个严重（CVSS 9.8）远程认证绕过漏洞，允许未经认证的攻击者立即获得 root 访问权限。该漏洞源于对 USER 环境变量的不当清理，该变量被直接作为命令行参数传递给 /usr/bin/login。通过设置 USER=-f root，攻击者触发 login 的 -f 标志，从而完全绕过认证。 受影响版本： GNU InetUtils 1.9.3 至 2.7 漏洞类型： CWE-88（参数注入）...

CVE-2024-4577

CVE-2024-4577 A Proof of Concept developed by @watchTowr exploiting the PHP CGI Argument Injection vulnerability CVE-2024-4577 to obtain RCE on a vulnerable PHP version running in a Windows environment. Detailed technical analysis for this vulnerability Orange Tsi 🍊 This vulnerability was found b...

RHEL 8 : ansible-core (RHSA-2026:66248)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66248 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH...