SUSE CVE-2026-17347

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-66065

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

CVE-2026-18733

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

CVE-2026-66065

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

CVE-2026-67324

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

perl-GD: perl-GD: Arbitrary command execution and file overwrite via crafted filenames

A flaw was found in perl-GD. A remote attacker could exploit this vulnerability by providing specially crafted filenames to functions that open files. This issue arises because the makefilehandle function uses Perl's 2-argument open with untrusted input, allowing special characters like pipes or...

Critical: Red Hat Security Advisory: perl-GD security update

An update for perl-GD is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Exploit for Server-Side Request Forgery in Sonicwall Sma6210_Firmware

🚀 CVE-2026-15409 – SonicWall SMA 1000 Erlang RCE via WebSocket...

Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

CVE-2026-18574

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

CVE-2026-18574

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

CVE-2026-18574 Authentication Bypass in Check Point Security Management Server

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

CVE-2026-18574 Authentication Bypass in Check Point Security Management Server

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

CVE-2026-18574

CVE-2026-18574 describes an authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server (MDS). Affected component: management services. Root cause: authentication bypass allowing an unauthenticated remote attacker with network access to execute arbi...

EUVD-2026-52265

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

clamav-zero-days

ClamAV 1.5.x Memory Corruption Vulnerabilities This is the mi...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

PT-2026-67502

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.0 Description A prompt injection issue in the shell tool allows remote actors to execute arbitrary operating system commands on the agent host. This is achieved by using a crafted prompt that...

VulnCheck KEV: CVE-2026-38992

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator...

CVE-2026-18574: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...