58022 matches found
php2shell
php2shell Reproducible HTTP proof of concept for the PHP requ...
EUVD-2026-107658
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...
RLSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update
Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...
lrzsz security, bug fix, and enhancement update
An update is available for lrzsz. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmode...
PT-2026-121584
Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description Authentication bypass flaws in the affected interface could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system if specific preconditions...
Linux Distros Unpatched Vulnerability : CVE-2026-96639
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a...
Rocky Linux 10.2 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_86056)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...
activate.sh Arbitrary Command Execution
The vulnerability in the activate.sh script src/virtualenv/activation/bash/activate.sh, a tool for creating isolated virtual environments in Python virtualenv, is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability could allow an attacker to...
virtualenv Arbitrary Command Execution
The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2026-76293
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...
Virtualenv Bash Activate Runs Commands From An Environment Name With A Backslash Before $
Summary The bash "activate" script escapes the environment name for only one of the two passes bash makes over "PS1", so a backslash in the name undoes the escaping and a name containing "$..." runs as commands in the user's shell each time bash draws the prompt. Affected area...
EUVD-2026-105304
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax...
DEBIAN-CVE-2026-96639
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...
CVE-2026-96639
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...
Virtualenv Activate Runs Commands From The Environment Name In Zsh With PROMPT_SUBST
Impact zsh users activate an environment with the bash "activate" script, which puts the environment name into "PS1". Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when "BASHVERSION" is set, so zsh gets the raw value. With the "PROMPTSUBST" option...
CVE-2026-96639
The Pillow Python imaging library (versions 11.0.0 through 13.0.0 ) is vulnerable to out-of-bounds memory operations in multi-frame loaders. The root cause is that ImageFile.load_prepare() reuses stale native storage from a narrow frame mode without verifying if the subsequent frame's mode and si...
CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...
CVE-2026-96639
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...
CVE-2026-96639
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...
CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...