47423 matches found
GHSA-JJ7C-H3WM-VJFW vulnerabilities
Vulnerabilities for packages: busybox...
GHSA-9R55-P3JW-V652 vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-16875
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...
CVE-2026-16848
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...
CVE-2026-16842
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16882
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain an OS command injection flaw (improper neutralization of special elements) exploitable remotely with no authentication; CVSS 9.8 critical. IBM reference: https://www.ibm.com/support/pages/node/7283858. Exploitation details not provided in documents.
EUVD-2026-62871
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
EUVD-2026-62873
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...
EUVD-2026-62742
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...
CVE-2026-16848
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to remote arbitrary command execution via improper neutralization of shell metacharacters in DHCP options. An unauthenticated attacker on an adjacent network can inject malicious shell characters through DHCP option fields, achieving full confid...
EUVD-2026-62733
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16844 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16842 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...
EUVD-2026-62699
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink...
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...
CVE-2026-75149
The marimo Python notebook framework (versions before 0.23.15) launches attacker-controlled commands embedded in a notebook's MCP server configuration as local subprocesses upon opening in edit mode, requiring no authentication or cell execution. CVSS 3.1 scores this HIGH (8.8). Upgrade to 0.23.1...
CVE-2026-75149 marimo < 0.23.15 Code Injection via MCP Server Configuration
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...
CVE-2026-23501
Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...