PT-2026-95685

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Insufficient argument validation in the SUID-root nmap wrapper binary on the Collector appliance allows a local attacker with low-privileged access to execute arbitrary commands as root. Th...

PT-2026-95225

Name of the Vulnerable Software and Affected Versions marcopiovanello yt-dlp-web-ui versions prior to v5 Description Remote command injection is possible through the manipulation of the params argument within the NewGenericDownload function located in the server/internal/downloaders/generic.go...

EulerOS Virtualization 2.11.0 : vim (EulerOS-SA-2026-3568)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the...

EulerOS Virtualization 2.11.1 : vim (EulerOS-SA-2026-3480)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the...

CVE-2026-92747: Invocation of Process Using Visible Sensitive Information

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection due to the hook editor handling in cmd/uniget/hooks.go. An attacker can execute arbitrary commands by setting EDITOR or UNIGETEDITOR to a value containing shell metacharacters and then invoking the hook...

CVE-2026-55061

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

EUVD-2026-82371

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-86864

A flaw was found in pgAdmin 4. An authenticated user with 'toolsbackup' permission can exploit an argument injection vulnerability in the Backup tool to create or overwrite arbitrary files on the system where pgAdmin is running. Additionally, a connection-string injection vulnerability allows the...

EUVD-2026-82340

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partnerpreference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-54577

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted localargv and localargc values but passed the original argument entry to auditpackage. When an operator or automation used an option such as -r before a package name, stale optind...

EUVD-2026-82320

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted localargv and localargc values but passed the original argument entry to auditpackage. When an operator or automation used an option such as -r before a package name, stale optind...

CVE-2026-54577

mport , the MidnightBSD Package Manager, contained a bug in its audit command prior to version 2.7.8. The function in mport/mport.c computed option-adjusted local arguments but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93295

MISP (Malicious Intelligence Sharing Platform) is vulnerable to remote code execution via its background job dispatch mechanism. User-controlled fields (person and message) from the events/contact endpoint are passed unvalidated into the CakePHP console process argv. An attacker sets person to a ...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...