EUVD-2026-70217

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

UBUNTU-CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

EUVD-2026-70148

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

CVE-2026-84675

The Jenkins TICS Plugin versions 2025.1.1 and earlier are vulnerable to an OS command injection flaw. The root cause is the failure to correctly escape build environment variable values when constructing OS commands. An attacker capable of controlling these environment variable values can execute...

EUVD-2026-70108

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by "rpmbuild -t" to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

Malicious code in appcenterclient (npm)

Source: ossf-package-analysis 1bc657665525c8990a4f9ac5c4f30181a8593678337e7f78667dfdba06d44922 The OpenSSF Package Analysis project identified 'appcenterclient' @ 7.7.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malicious code in api-react125 (npm)

Source: ossf-package-analysis d2f6ad3f3d48477a940b0ade2ae623d9001486fb2dee5c4f448fa429a9165879 The OpenSSF Package Analysis project identified 'api-react125' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in peertube-plugin-poc-marker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c index.js runs id; uname -a; hostname; date -u; ls -d /var/www/peertube via execSync when PeerTube invokes the plugin's register hook, then POSTs the...

ROS-20260902-73-0016

The vulnerability in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

PT-2026-84798

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

OS command injection vulnerability on agents in tics

tics 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes. This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build. tics 2026.1.0 correctly escapes...

ROS-20260902-73-0001

The vulnerability in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-79754: Improper Neutralization of Special Elements used in a Command

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-84837: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

PT-2026-84822

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

Switchvox pa endpoint SQL injection

Added: 09/02/2026 CVE: CVE-2026-9586 Background Switchvox is a VoIP and Unified Communications phone system. Problem An SQL injection vulnerability exposed by the unauthenticated /pa endpoint could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Switchvox 8.4.0.2 or...

D-Link DNS-327L DNS-340L Arbitrary Command Execution Unauthorized Access

The vulnerability in the cgi/diskmgr/vemgr.cgi script of the D-Link DNS-327L and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gain...