57967 matches found
PT-2026-99139
Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists in the export data function within the HorillaListView class located in horilla views/generic/cbv/views.py. The application accepts a columns POST parameter from an authenticated user...
PT-2026-99117
Name of the Vulnerable Software and Affected Versions CliInvoke versions 2.0.0 through 2.8.4 CliInvoke versions 2.9.0 through 2.9.3 CliInvoke versions 2.10.0 through 2.10.4 CliInvoke versions 3.0.0-alpha.1 through 3.0.0-beta.1 AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0 Descripti...
ROS-20260925-73-0099
The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
PT-2026-98865
Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...
CVE-2026-91838: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped...
PT-2026-98841
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color control in kitty/window.py...
CVE-2026-95832: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...
Linux Distros Unpatched Vulnerability : CVE-2026-95521
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to...
Linux Distros Unpatched Vulnerability : CVE-2026-95832
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions. The wrappers re-run a caller-supplie...
Linux Distros Unpatched Vulnerability : CVE-2026-79310
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...
GitPython Command Execution
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
libssh Arbitrary Command Execution
The vulnerability of the libssh library is related to the lack of measures taken to clean data at the administrative level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...
Vim Command Injection
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2026-85542: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...
org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...
Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
GHSA-3CJ3-HQCR-G934 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...
