CVE-2026-67323

GitPython < 3.1.51 is affected. The vulnerability stems from failing to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), enabling command injection via options like --exec and --upload-pack. Additionally, Repo.iter_commits() and Repo.blame(...

PT-2026-66772

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 7.2 through 9.16 Description An issue exists in the MASTER PASSWORD HOOK setting where the application substitutes the username directly into a command string and executes it using subprocess.Popen..., shell=True. Since...

JLSEC-2026-1032 ImageMagick: Memory Leak in wand option parser when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25...

JLSEC-2026-1039 ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

CVE-2026-41186 affects Calico components (kube-controllers and Goldmane) where an opt-in Go pprof debug listener, if enabled, binds to 0.0.0.0 and allows unauthenticated access. This exposes the process heap, goroutine stacks (including function arguments), and command-line arguments to any pod w...

CVE-2026-62363

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...

CVE-2026-67438

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-18236

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

PT-2026-65910

Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.2.0 through 3000.16.0 Description OS command injection is possible because the checkShellArgumentSafety function in service/internal/executor/arguments.go fails to treat regex: custom argument types as unsafe for Shell...

SUSE CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2026-45293

WordPress Coding Standards (WordPressCS) contains a vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. From 0.14.1 to 3.4.1, the sniff reconstructed the $ver argument passed to functions like wp_enqueue_script() and ran it through eval() inside is_falsy(), so a crafted argument s...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

Linux Distros Unpatched Vulnerability : CVE-2025-71408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

DEBIAN-CVE-2026-66011

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...

UBUNTU-CVE-2026-66011

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...

EUVD-2026-49042

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...