CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

Ivanti EPMM pre-auth RCE Dummy Target A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability CVE-2026-1281 / CVE-2026-1340 for educational and security research purposes. Vulnerability Overview This vulnerability exploits Bash arithmetic expansion behavio...

CVE-2026-122043

repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability CWE-78 in event notifications. When eventnotificationcommand is configured, repmgr substitutes the %a node name, %c connection string and %d details placeholders into the command and runs it through the shell. %a and ...

CVE-2026-122043

repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability CWE-78 in event notifications. When eventnotificationcommand is configured, repmgr substitutes the %a node name, %c connection string and %d details placeholders into the command and runs it through the shell. %a and ...

CVE-2026-122043

repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability CWE-78 in event notifications. When eventnotificationcommand is configured, repmgr substitutes the %a node name, %c connection string and %d details placeholders into the command and runs it through the shell. %a and ...

CVE-2026-122043

repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability CWE-78 in event notifications. When eventnotificationcommand is configured, repmgr substitutes the %a node name, %c connection string and %d details placeholders into the command and runs it through the shell. %a and ...

EUVD-2026-123579

repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability CWE-78 in event notifications. When eventnotificationcommand is configured, repmgr substitutes the %a node name, %c connection string and %d details placeholders into the command and runs it through the shell. %a and ...

CVE-2026-122043

The repmgr replication manager (versions 4.0.0 through 5.5.0 ) is vulnerable to an OS command injection (CWE-78) within event notifications. When event_notification_command is used, the software substitutes placeholders like %a (node name), %c (connection string), and %d (details) into shell comm...

CVE-2026-121751

Node Version Manager (nvm) versions 0.39.6 through 0.40.8 are vulnerable to OS command injection via shell arithmetic evaluation. The nvm ls-remote command stores unvalidated version strings from a mirror's index.tab into $NVM_DIR/alias/lts/. Subsequently, nvm_normalize_lts evaluates these string...

CVE-2026-121751 nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-121751 nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

EUVD-2026-115629

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-116958

A flaw in konflux-ci allows for arbitrary code execution because of improper quoting of shell variables within deployment scripts. A local attacker capable of providing arguments to the affected scripts can trigger unintended command substitution, resulting in the execution of commands with the p...

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

MAL-2026-18376 Malicious code in black-spindle-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90 package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embeddi...

CVE-2026-114278

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278

The che-machine-exec service is vulnerable to unauthenticated command injection because it constructs shell commands by concatenating user-controlled input from the /exec/init and /exec/config JSON endpoints without proper escaping. Specifically, the username and namespace fields are inserted int...