PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...

PT-2026-120140

Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...

PT-2026-120321

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

Red Hat: CVE-2026-112177: ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

PT-2026-118599

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

PT-2026-120301

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

PT-2026-118635

Name of the Vulnerable Software and Affected Versions Kiro Crew versions prior to 0.7.2 Description Missing authorization in the WhatsApp group channel allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions of the operator. This occurs becau...

PT-2026-117952

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import 'subprocess' to run commands, stealing environment...

ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

Linux Distros Unpatched Vulnerability : CVE-2026-112177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to...

CentOS 9 : vim-8.2.2637-42.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-42.el9 build changelog. - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a...

DEBIAN-CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-106583

A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout. Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys th...

CVE-2026-112774

Craft CMS versions 5.8.0 before 5.11.0 are vulnerable to Remote Code Execution (RCE) . The flaw exists in the ContentBlock::setFieldLayout() function, where authenticated administrators can inject Yii behaviors by providing a JSON-string field layout. If the allowAdminChanges setting is enabled, ...