290325 matches found
EUVD-2026-61206
Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-59915
Dell Alienware Command Center versions prior to 6.14.20.0 have a Least Privilege Violation flaw allowing a low-privilege local attacker to escalate privileges. Dell published advisory DSA-2026-334 recommending an update to 6.14.20.0. No exploit or in-the-wild exploitation details are provided in ...
CVE-2026-49500
Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privilege...
CVE-2026-49500
Dell Alienware Command Center versions prior to 6.14.20.0 have a link-following flaw exploitable by a low-privileged local attacker, enabling DoS and privilege escalation (CVSS 6.0, MEDIUM). No in-the-wild exploitation reported; update to 6.14.20.0 to remediate. Dell DSA-2026-334 advisory availab...
EUVD-2026-61204
Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privilege...
Malicious code in infogram-bot (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...
MAL-2026-14131 Malicious code in infogram-bot (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...
Malicious code in httpz-requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc httpz-requests exposes a Telegram bot startbot, runcmdenc, httprequest whose message handler executes arbitrary shell commands on the host running th...
MAL-2026-14130 Malicious code in httpz-requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc httpz-requests exposes a Telegram bot startbot, runcmdenc, httprequest whose message handler executes arbitrary shell commands on the host running th...
CVE-2026-71551
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...
CVE-2026-63641
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...
CVE-2026-54552
sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...
DEBIAN-CVE-2026-53533
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...
CVE-2026-53533
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...
Security update for erlang
This update for erlang fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...
CVE-2026-71551
The EXEC IPC handler in electron/ipc-handlers/exec.ts passes arbitrary commands via child_process.exec() without requiring nodeExecution permission. Community plugins run with new Function() can call window.ea.exec() to execute OS commands under the desktop account's privileges. The confirmation ...
CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...
CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...
EUVD-2026-61102
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...
CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...