PT-2026-64476

Name of the Vulnerable Software and Affected Versions Catalyst::View::Wkhtmltopdf versions prior to 0.6.1 Description Shell command injection is possible via PDF render options because options are passed directly to the wkhtmltopdf command without sanitization. Web applications that pass...

Linux Distros Unpatched Vulnerability : CVE-2026-56624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH use...

Linux Distros Unpatched Vulnerability : CVE-2026-16461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump short mode used by rpcinfo -s, version numbers from a remote RPCBPROCDUMP repl...

Linux Distros Unpatched Vulnerability : CVE-2026-58624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client- side and server-side SSH. Component...

PT-2026-64554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the digi acceleport USB serial driver where the digi write inb command function fails to correctly handle timeouts. Instead of returning an error when a write URB USB...

PT-2026-64761

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-27 Description A memory leak exists in the magick command-line interface. This occurs when invalid options are provided, allowing an attacker to trigger memory exhaustion by repeatedly supplying malformed...

GHSA-J6G5-3HH3-PGW8 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

DEBIAN-CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

UBUNTU-CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the terminal process. An attacker can execute arbitrary commands on the host system by supplying crafted arguments to allowlisted binaries, bypassing command restrictions through argument injection. This...

CVE-2025-71408

The CVE-2025-71408 issue affects NLTK up to version 3.9.2 (pre-3.9.3). The vulnerability lies in nltk.collocations’ main path, where command‑line arguments are passed directly to eval() to form BigramAssocMeasures suffixes without a allowlist or sanitization, enabling an attacker who can control ...

CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

GHSA-6V4J-43GG-VJ32 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Summary If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...

CVE-2026-65711

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

GHSA-R9MR-M37C-5FR3 GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...

GHSA-6P8H-3WGX-97GF GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

Summary GitPython's unsafegitcloneoptions denylist omits --template. git clone --template= copies /hooks/ into the new repository and runs them post-checkout fires during clone, so a caller who can influence clone options can achieve arbitrary command execution in the default...