EUVD-2026-67272

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

CVE-2026-37003

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

PT-2026-82486

Name of the Vulnerable Software and Affected Versions Zbtlink L3 V2 8 version 3.0.0.4.528 Zbtlink WE826-T2 version 19.1101 Zbtlink ZBT-7628 version 1.0.0.2.007 Zbtlink ZBT-ZBT7621 version 1.0.0.3.001 MoreQuick MQAC-7620 version 1.0.0.2.000 MoreQuick MQAC-7620A version 1.0.0.2.000 MoreQuick...

PT-2026-82567

Name of the Vulnerable Software and Affected Versions mcp-router versions prior to 0.6.3 Description The CLI serves its MCP aggregator on every network interface by default and only enforces authentication if explicitly requested by the operator. In the serve command located in...

PT-2026-82570

The execute ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

Linux Distros Unpatched Vulnerability : CVE-2026-80158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind...

RockyLinux 10 : ruby4.0 (RLSA-2026:50773)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50773 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

TencentOS Server 3: vim (TSSA-2026:0916)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0916 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: dracut (TSSA-2026:0902)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0902 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Security update for liboqs (moderate)

openSUSE security update: security update for liboqs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21634-1 Rating: moderate References: bsc1215751 bsc1246301 bsc1267001 bsc1267007 Cross-References: CVE-2025-52473 CVE-2026-44518 CVE-2026-46344 CVSS...

PHP Composer -- Multiple vulnerabilities

Composer project reports: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Fixed command injection via malicious Perforce url GHSA-rvx4-ffvw-m9q3...

...[ More ]

An unauthenticated remote debugger vulnerability exists in Escargot version 4.3.0-214-gfaee4437 when the application is compiled with ESCARGOTDEBUGGER support and the debug server is enabled using --start-debug-server. The debugger accepts client connections without authentication or authorizatio...

gosentry v0.4.1

gosentry gosentry is a security-focused fork of the Go toolchain, integrating numerous features for state-of-the-art fuzzing campaigns on Go codebases. If you were using go test -fuzz before, you should use gosentry as a replacement. It comes with various fuzzing improvements and bug detectors th...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

DEBIAN-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

UBUNTU-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-55182

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

curl: 46: `--libcurl` output carries `--insecure` across `--next` boundaries

Summary When --libcurl generates C source for a command that uses --next to separate multiple operations, local options from earlier operations leak into later ones. Specifically, if the first operation uses --insecure and the second does not, the generated program silently skips TLS certificate...