PT-2026-85030

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-85376

Name of the Vulnerable Software and Affected Versions OPCFoundation OPC UA LocalDiscoveryServer versions prior to 1.04.420 Description A privilege-escalation flaw exists in the installer that allows local attackers with keyboard and display access to intercept a high-privilege console during...

CVE-2026-84832: Deserialization of Untrusted Data

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...

...[ More ]

This Metasploit module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-84165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

EUVD-2026-64018

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools...

Malicious code in bc-nuxt-vue-starter (npm)

Source: ossf-package-analysis a07ad7d45dd2f1165c59df4d8cd0fae05829dcca27e3804324adb715d3cf966d The OpenSSF Package Analysis project identified 'bc-nuxt-vue-starter' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in bbc-iplayer-sounds-chatbot (npm)

Source: ossf-package-analysis 2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a The OpenSSF Package Analysis project identified 'bbc-iplayer-sounds-chatbot' @ 5.2.3 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in baidu-src-test (npm)

Source: amazon-inspector 7b70672e328a6c37f9f5a2f333c52648043af35a44d4a7c33fce30d4dde10869 The package baidu-src-test was found to contain malicious code. Source: ossf-package-analysis 1493238c2d847f5a7cbc807a1306e16c6e68b74612e8a28c1e2ada732eb952bb The OpenSSF Package Analysis project identified...

Malicious code in aurora-webmail-pro (npm)

Source: ossf-package-analysis b196e5cdd7ecb9e38cd0eb47dfc5a3b78a6533ffeb8c52c9f43722b3f398a983 The OpenSSF Package Analysis project identified 'aurora-webmail-pro' @ 10.1.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79754

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

EUVD-2026-70217

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

UBUNTU-CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...