94974 matches found
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79756
The Nuclio serverless framework (versions prior to 1.17.4 ) is vulnerable to unauthenticated OS command injection within the dashboard on local/Docker platforms. The root cause is an incomplete fix where the list-all resource path (triggered when no specific resource name is provided) still inter...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
EUVD-2026-70219
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
EUVD-2026-70218
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...
CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...
CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...
CVE-2026-79755
CVE-2026-79755 affects Nuclio , a Serverless framework for real-time events and data processing. On the local Docker platform , prior to version 1.17.4 , the function namespace is interpolated unvalidated into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command executed via /b...
CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...
CVE-2026-79754 Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...
CVE-2026-79754
Nuclio , a serverless framework for real-time events and data processing, is affected by a command injection in its Dashboard build pipeline. Between versions 1.6.19 and 1.17.1 , the spec.build.tempDir field is not sanitized before being used to construct a shell command. When the Kaniko containe...
CVE-2026-79754 Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...
AZL-99372 CVE-2026-84838 affecting package rpm 4.18.2-2
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84837
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...
CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84675
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...
CVE-2026-53611
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...
CVE-2026-84837
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...
UBUNTU-CVE-2026-84837
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...