193471 matches found
RHLW-2026-FB860419F051AEDD Lightwell Security Advisory: netty-codec-smtp 4.1.100.Final-rhlw-00001
Red Hat Lightwell has released io.netty:netty-codec-smtp 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2025-59419: Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery This patched artifact is a drop-in replacement for io.netty:netty-codec-smtp...
AccuKnox-DVWA-Kubernetes
DVWA on Kubernetes — Security Testing Lab 1. Project Overv...
CLSA-2026-1791489381 vim: Fix of 2 CVEs
CVE-2026-73072: fix heap buffer overflow in setsofo with a crafted spell file upstream 9.2.0846 - CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu entries upstream 9.2.0840...
EUVD-2026-95929
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
EUVD-2026-95912
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797
The Argo CD repo-server is vulnerable to command injection (CWE-78) in versions 2.11.0 through 3.3.15 , 3.4.10 , 3.5.4 , and 3.6.0-rc2 . The root cause is the execution of an SSH ProxyCommand containing a proxy host and port through a shell without neutralizing shell metacharacters. An attacker w...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...
GHSA-J6CW-G6P4-7HCH Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...
CLSA-2026-1791563692 Fix CVE(s): CVE-2021-45463
SECURITY UPDATE: shell command injection via the image path - debian/patches/CVE-2021-45463.patch: run convert with gspawnsync instead of system in loadcache operations/common/magick-load.c - CVE-2021-45463...
CLSA-2026-1791563013 Fix CVE(s): CVE-2022-4055
SECURITY UPDATE: -compose argument injection in runthunderbird - debian/patches/CVE-2022-4055.patch: strip ' from to=/cc=/bcc=/attach= and escape , ' and " in subject=/body= in scripts/xdg-email.in - CVE-2022-4055...
EUVD-2026-95907
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...
SpotWeb command injection vulnerability
Versions of spotweb 1.5.8 and earlier have a command injection vulnerability. This vulnerability stems from OS command injection in the runcommand NZB processor. Attackers can exploit this vulnerability by issuing a spot with a malicious title, replacing the shell metacharacter without escaping i...