ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85451

MOOS core-moos through 10.4.0 is affected by a remote process termination vulnerability in the SuicidalSleeper component. The root cause is a hard-coded passphrase used for multicast command authorization, allowing any multicast-reachable peer to enumerate MOOS processes and send termination comm...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85439

MOOS-IvP through 24.8.1 contains a command injection vulnerability in alogsplit 's SplitHandler::handlePreCheckSplitDir() function, which fails to sanitize shell metacharacters in log file pathnames. An attacker can embed shell syntax in log file names or the --dir parameter to execute arbitrary ...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

CVE-2026-85426

MOOS-IvP uMemWatch (through version 24.8.1) is vulnerable to command injection via MOOS client names. The component constructs shell commands from attacker-controlled client names without sanitization, specifically through unquoted redirection targets in system calls (see MemWatch.cpp). An attack...

CVE-2026-85425

MOOS-IvP versions through 24.8.1 contain a remote code execution vulnerability in the SAY_MOOS variable handler of the iSay component. The handler passes unsanitized text to a shell command, allowing attackers to publish SAY_MOOS messages containing backticks or command substitution syntax to exe...

CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

lure v0.7.1

lure Local Linux binary analysis. Zero cloud. Zero root. Zero cost. lure is a local Linux ELF analysis and sandboxing tool for security researchers, reverse engineers, and CTF players. Version 0.7.1 adds ARM64 binary support via QEMU user-mode emulation. It provides three complementary workflows:...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...