CVE-2026-18157

CVE-2026-18157 concerns the yggdrasil-worker-package-manager. A local attacker with existing system access can exploit an argument injection vulnerability in the APT backend, where specially crafted package names beginning with a hyphen are misinterpreted as apt-get options. Successful exploitati...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

EUVD-2026-51380

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

PT-2026-66668

Name of the Vulnerable Software and Affected Versions yggdrasil-worker-package-manager affected versions not specified Description An argument injection flaw exists in the APT backend. A local attacker with system access can use specially crafted package names starting with a hyphen to trick...

GitPython Command Injection

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2026-75899

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0 Description Improper validation of the block.create options variable in storage volume configuration allows a project-scoped user to perform argument injection. This occurs during the construction of the filesyste...

PT-2026-66872

Name of the Vulnerable Software and Affected Versions gemini-bridge versions 1.0.0 through 1.3.0 Description The consult gemini with files function in inline mode allows an arbitrary local file read. When the mode is set to "inline", the server reads any file path provided in the files argument...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

SUSE CVE-2026-48709

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not cal...

JLSEC-2026-1080 ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...

JLSEC-2026-1040 ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26...

GHSA-XC5W-4V5W-7X65 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

CVE-2026-62363

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...

CVE-2026-62363

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...

CVE-2026-62363 ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...

CVE-2026-67438

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...