CVE-2026-59774

Summary An unauthenticated remote attacker can submit Org-mode markup containing a +INCLUDE directive to POST /owner/repo/markup for any suitable public repository to read arbitrary server files. By extracting INTERNALTOKEN from app.ini, they can inject a Git hook through the internal logger and...

CVE-2020-7247

CVE-2020-7247 This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtpmailaddr” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user How to use? python3 getShell.py If you need a reverse shell then run it...

EUVD-2026-97779

PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...

CVE-2026-109289 Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated...

[SECURITY] [DLA 4831-1] libgit2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4831-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 12, 2026 https://wiki.debian.org/LTS -...

CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

CVE-2026-103528 CVE-2026-103528

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

CVE-2026-103528

The open-source e-commerce platform Thelia v2.6.0 is vulnerable to Remote Code Execution (RCE) due to improper restrictions on the Smarty template engine . An authenticated administrator can inject malicious Smarty expressions into email templates through the messages configuration interface . Wh...

EUVD-2026-97480

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

CVE-2026-109199

LogicalDOC Community Edition versions through 9.3 are vulnerable to a code injection vulnerability within the DocumentService.sendAsEmail function. The flaw allows authenticated users to execute arbitrary OS commands by submitting malicious Velocity templates in the subject or message fields. Att...

Important: Red Hat Security Advisory: goose security update

An update for goose is now available for Red Hat Enterprise Linux 10. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: Arbitrary command execution via malicious Git configurati...

goose: Goose: Arbitrary command execution via malicious Git configuration in `goose review`

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitra...

goose: Goose: Arbitrary command execution via malicious Git configuration in `goose review`

A flaw was found in goose, a general-purpose AI agent. The goose review command, which uses the system's Git executable, does not properly strip attacker-controlled Git configuration. A malicious Git repository can set the core.fsmonitor option in its configuration, causing Git to execute arbitra...

Important: Red Hat Security Advisory: goose security update

An update for goose is now available for Red Hat Enterprise Linux 9. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: Arbitrary command execution via malicious Git configuratio...

CVE-2026-105407

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Debian dsa-6556 : nagios4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6556 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/securit...

TencentOS Server 4: gdb (TSSA-2026:1081)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1081 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : containerd (EulerOS-SA-2026-4035)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4217)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...