CVE-2026-105407

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-103528: Improper Neutralization of Special Elements Used in a Template Engine

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

Debian dsa-6556 : nagios4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6556 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/securit...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4308)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

TencentOS Server 4: crash (TSSA-2026:1082)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1082 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: gdb (TSSA-2026:1081)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1081 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : containerd (EulerOS-SA-2026-4035)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...

EulerOS 2.0 SP13 : containerd (EulerOS-SA-2026-4126)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...

PT-2026-110614

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The software uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4217)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

ysoserial

ysoserial Una herramienta de prueba de concepto para generar cargas útiles que explotan la deserialización insegura de objetos Java. Descripción Publicada originalmente como parte de la charla de AppSecCali 2015 "Marshalling Pickles: how deserializing objects will ruin your day" con cadenas de...

gping

gping 🚀 Ping, pero con un gráfico. Viene con los siguientes superpoderes: Graficar el tiempo de ping de múltiples hosts Graficar el tiempo de ejecución de comandos mediante la opción --cmd Colores personalizados Soporte para Windows, Mac y Linux Table of Contents Instalación 💿 Uso 🎷 Instalación 💿...

ysoserial.net

Una herramienta de prueba de concepto para generar payloads que explotan la deserialización insegura de objetos .NET. Descripción ysoserial.net es una colección de utilidades y "cadenas de gadgets" de programación orientada a propiedades descubiertas en bibliotecas .NET comunes que pueden, bajo l...

b374k

b374k shell 3.2 Este PHP Shell es una herramienta útil para administradores de sistemas o web para realizar gestión remota sin usar cpanel, conectarse mediante ssh, ftp, etc. Todas las acciones se realizan dentro de un navegador web. Características: Gestor de archivos ver, editar, renombrar,...

Malicious code in eth-gas-oracle (RubyGems)

Source: amazon-inspector 0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during gem install. The decoded payload opens a...

wshlient

Wshlient Cliente de Web Shell Descripción y Demo Wshlient es un cliente de web shell diseñado para ser bastante simple pero versátil. Solo necesitas crear un archivo de texto que contenga una solicitud HTTP e indicar dónde Wshlient inyecta los comandos, luego puedes disfrutar de una shell...

MAL-2026-17786 Malicious code in eth-gas-oracle (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked,...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool es una herramienta de pruebas de penetración de código abierto que prueba la seguridad de las bases de datos Microsoft SQL de forma remota. Ejemplos de uso de MSDAT: Tiene una ba...

vaas-cve-2014-6271

Vulnerabilidad como Servicio - CVE 2014-6271 Un sistema Debian Buster Linux con una versión vulnerable de bash y una aplicación web para mostrar CVS-2014-6271, también conocido como Shellshock. Resumen Este contenedor Docker está basado en Debian Buster y ha sido modificado para usar una versión...