97294 matches found
CVE-2026-68939
Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...
CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...
CLSA-2026-1787064466 Fix CVE(s): CVE-2026-40176, CVE-2026-40261
Non-maintainer upload by the TuxCare ELS team. CVE-2026-40261: Prevent a command injection vulnerability in Perforce::syncCodeBase, which appended the source reference to the 'p4 sync -f' command without escaping. Package metadata served by a malicious or compromised Composer repository could...
GO-2026-6248 uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli
uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli...
GO-2026-6145 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin
OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin...
CVE-2026-24301
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...
Microsoft Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...
EUVD-2026-60762
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...
pcp security update
An update is available for pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Performance Co-Pilot PCP is a suite of tools, services, and libraries for...
RLSA-2026:55617 Important: pcp security update
Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: PCP: PCP...
RUSTSEC-2026-0271 FTP command injection via CRLF in control channel arguments
Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...
FTP command injection via CRLF in control channel arguments
Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...
D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect
Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...
ipTIME EAD UDP Service Detection (56026)
Detects ipTIME routers exposing the EAD UDP service on port 56026. On affected firmware e.g. A3004T 14.19.0, this endpoint is reachable without authentication and is associated with pre-auth command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ipTIME EAD UDP service port 56026...
ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)
Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...
D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)
CVE-2024-10914: unauthenticated OS command injection in /cgi-bin/accountmgr.cgi cmd=cgiuseradd. The name parameter is concatenated into system without sanitisation. Affects EOL models including DNS-320, DNS-320LW, DNS-325, and DNS-340L. Command output is returned in the HTTP response. Opens an...
SUSE-SU-2026:23191-1 Security update for python311
This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for...
CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...
