Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/irdma: Fixed a data race on the CQP request done field. KCSAN detected a data race in the cqprequest-requestdone memory location. This location is accessed without a lock in the irdmahandlecqpop function, while it is bein...

Astra Linux – Vulnerability in OpenSSH

In SSH in OpenSSH before version 9.6, OS command injection could occur if a user name or host name contained shell metacharacters, and this name was referenced by an expansion token in certain situations. For example, a untrusted Git repository might contain a submodule with shell metacharacters ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: The full-feature receive buffers are posted after session registration. isertputlogintx posts the full-feature receive buffers before transportregistersession is executed. As a result, an initiator that does not wait fo...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

MAL-2026-17568 Malicious code in req-throttle-mini (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in req-throttle-mini (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a null pointer dereference in the gdisurfacebits function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disable...

K000163537: Vim vulnerability CVE-2026-73073

Security Advisory Description Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated...

MAL-2026-17562 Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

Cacti <=1.2.22 - Remote Command Injection

Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype This script will get you initial access. First, Install required modules using pip pip3 install -r requirements.txt Usage python3 exploit.py 'id' or python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

K000163534: Ruby vulnerabilities CVE-2026-42245, CVE-2026-42246, CVE-2026-42257

Security Advisory Description CVE-2026-42245 Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. ...

CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

Cisco ASA OS Command Injection (CVE-2020-3167)

A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

PT-2026-106174

Name of the Vulnerable Software and Affected Versions CUPS affected versions not specified Description An argument injection flaw exists in the CUPS scheduler when email notification is configured. The system accepts printer subscription requests containing a mailto notify-recipient-uri, which is...

ALSA-2026:75769 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

CVE-2026-105767: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105691: Improper Neutralization of Special Elements used in an OS Command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...