initroot

initroot: Injeção de Linha de Comando do Kernel do Bootloader Motorola, Bypass de Boot Seguro e Bloqueio de Dispositivo CVE-2016-10277 Por Roee Hay / Aleph Research, HCL Technologies Primeiro estágio do exploit: Jailbreak Tethered Este exploit obtém acesso root irrestrito e efêmero no dispositivo...

CVE-2026-81684

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

EUVD-2026-67040

In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2025-38676

CVE-2025-38676 — Kernel Linux ≤ 6.17-rc2 AMD IOMMU buffer overflow dello stack Questo repository fornisce risorse PoC sicure e non exploit per studiare CVE-2025-38676: Strumenti di raccolta informazioni e sicurezza Harness di avvio QEMU per esercitare permutazioni di cmdline del kernel lunga Guid...

PYSEC-2026-3666 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

EUVD-2026-60303

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982

Glances versions 4.5.2 to 4.5.5 allow OS command injection via process cmdline values: _sanitize_mustache_dict() in glances/actions.py skips nested strings, letting pipe characters pass through chevron.render() and execute via secure_popen() in administrator-configured action templates. Fixed in ...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-74873

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...

vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...

EUVD-2026-41423

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the...

PT-2026-55293

Name of the Vulnerable Software and Affected Versions JuiceFS versions prior to 1.3.2 Description An authentication bypass exists due to improper handler registration on the shared http.DefaultServeMux. This allows unauthenticated remote attackers to access sensitive debug and metrics endpoints...

CVE-2026-48770

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WMCOPYDATA message to Notepad++ using the COPYDATAFULLCMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded...

CVE-2026-48770

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WMCOPYDATA message to Notepad++ using the COPYDATAFULLCMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded...