OPENSUSE-SU-2026:21878-1 Security update for ruby3.4

This update for ruby3.4 fixes the following issues: - CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations bsc1250016. - CVE-2026-27820: insufficient checks in zstreambufferungets can lead to a buffer overflow bsc1259239. - CVE-2026-41316: erb: @init...

[SECURITY] [DLA 4785-1] zip security update

Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS Package : zip Version : 3.0-13+deb12u1 CVE ID : CVE-2018-13410 Debian Bug : 903196 1005943 1077054 1093629 1143866 Multiple minor...

OPENSUSE-SU-2026:21874-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-67322: environment-variable exfiltration in Repo.clonefrom URL via os.path.expandvars bsc1273357. - CVE-2026-67323: unguarded Git options passed as keyword arguments in Repo.archive and git.lsremote allow for command injectio...

OS Command Injection

@cyclonedx/cyclonedx-npm is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of the untrusted --workspace value when constructing a Windows shell command, which allows an attacker to inject shell metacharacters and execute arbitrary operating-system commands...

virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...

PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...

CVE-2026-93371

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371

A command injection vulnerability exists in marcopiovanello/yt-dlp-web-ui up to v4 , specifically in the NewGenericDownload function within server/internal/downloaders/generic.go. Manipulation of the params argument allows a remote, unauthenticated attacker to execute arbitrary commands with no u...

EUVD-2026-82640

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

PYSEC-2026-4014 Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator withno escaping at all. --prompt, the VIRTUALENVPROMPT environment variable,and the config file all set the prompt, and activate.bat writes it straightinto @set "VAR=value". A prompt containing a double quote closes that...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82588

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

EUVD-2026-82582

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-81937: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelogconfig file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root...

Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the createDBLink method. The issue results from the lac...

CVE-2026-84082: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...