CVE-2026-81467

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

EUVD-2026-75568

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81467

Dell ThinOS 10 (versions prior to 2605_10.2616 ) is affected by an OS Command Injection vulnerability. An unauthenticated attacker with remote network access can exploit this flaw to achieve arbitrary command execution on the device. Dell assigned a CVSS v3.1 score of 9.8 (Critical) , reflecting ...

GO-2026-6358 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo...

CVE-2026-88886

A flaw was found in Renovate. The manager/gradle-wrapper module does not properly escape the distributionUrl value from a repository's gradle/wrapper/gradle-wrapper.properties file. In self-hosted deployments configured with binarySource=docker and allowedUnsafeExecutions='gradleWrapper', ..., a...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

Malicious code in false-positive-reddit-rce (npm)

Source: ossf-package-analysis 18d0061817c889d31df1f475a5cb984705a83ac9e8117ef32c2429696d73ca20 The OpenSSF Package Analysis project identified 'false-positive-reddit-rce' @ 0.0.2 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...

Malicious code in fabric-integration (npm)

Source: ossf-package-analysis 95e54d11b0e8b8ae3ec65bb015b953544d6e1b0e8e8d5ac3ebe884d858528d42 The OpenSSF Package Analysis project identified 'fabric-integration' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in exszpe3szs (npm)

Source: amazon-inspector 67f15551a64777edf23687b4e056220380ac9501b76e432e33f9d93f5aecf2d3 The package exszpe3szs was found to contain malicious code. Source: ossf-package-analysis 3bc14fbd9fa6d961f6b0e4e4b389e7aaefd494b9893d2e544178b2dc5f5e62f1 The OpenSSF Package Analysis project identified...

Malicious code in exprrrress (npm)

Source: amazon-inspector f3605883655f4870250aaab1c630151c6264e54521d1a711a088871de1fe5ea5 The package exprrrress was found to contain malicious code. Source: ossf-package-analysis 387d72a157f82d564aa36555abaa204465c769f4e5a5617458dc6bbc20f12b9a The OpenSSF Package Analysis project identified...

Malicious code in experedzss (npm)

Source: amazon-inspector f70a37180c88f0ddd0cc94346d4bb7703667321771ecc6de6c9c74f03a77f464 The package experedzss was found to contain malicious code. Source: ossf-package-analysis a93c7a3f654f6443a589bbeec7a013cfc4f478f2d86358be4252ec2e73e44433 The OpenSSF Package Analysis project identified...

Malicious code in exaprse (npm)

Source: amazon-inspector c6cac7f3a62099b4980a3948c78a3a231085dece3eac1d5ca3aa0bc3b0d102e5 The package exaprse was found to contain malicious code. Source: ossf-package-analysis e6b772ab3336f1923332b7f4042b5daa8ea5fdef08b605e35f6410c40f6a257f The OpenSSF Package Analysis project identified 'exaprs...

Malicious code in examples-lib (npm)

Source: ossf-package-analysis 518ba4bb1adf28c3721d2c8ff48d014ef14b3672e262a2f6eaa8acbe3a8f0823 The OpenSSF Package Analysis project identified 'examples-lib' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in ewf-mfe (npm)

Source: ossf-package-analysis e96ce38b2b02ec78407045e7181bcefa077eebf81fbefa6bee1e97f35a50e74d The OpenSSF Package Analysis project identified 'ewf-mfe' @ 7.8.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The...

Malicious code in ethers-logger (npm)

Source: ossf-package-analysis 8f43ab2ac9caeed4f5dd0895f4da7d3a646038768f5d0024f443bb527fd1ad95 The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in ethers-5 (npm)

Source: amazon-inspector 8842d229aa4e9c24c85ce8a9be99c6690dbf62bef2bdf2ef716865c8a44adda3 The package ethers-5 was found to contain malicious code. Source: ossf-package-analysis f92a03425cd97c753a2412a2f070a5844bfef3fb64534fe79fc37dec3dda5e28 The OpenSSF Package Analysis project identified...

Malicious code in eslint-oldest (npm)

Source: ossf-package-analysis f80ac33a577e9ac06744364bddec668b736dd3e0f4a48d532c2dbdcb368e21b0 The OpenSSF Package Analysis project identified 'eslint-oldest' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...