156496 matches found
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection
Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either getDiagnosticsData or...
MAL-2026-14349 Malicious code in boto4 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa setup.py defines a custom setuptools install command EjecutaElf that base64-decodes a 17MB embedded Linux ELF, writes it to /tmp/.systemd-helper,...
Splunk Enterprise’s vulnerabilities are exploited through Splunk
Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...
Malicious code in moidevy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...
CVE-2026-76156
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
EUVD-2026-63794
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
CVE-2026-76156
Datiphy Data Management Center v8.3.0 through v8.5.1 has an OS command injection flaw (CWE-78) in its API endpoint, allowing authenticated administrators to execute arbitrary OS commands as root. No patch version or workaround is mentioned in the provided documents. Exploitation details are not p...
CVE-2026-77649
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
SUSE CVE-2026-65611
nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...
SUSE CVE-2026-65612
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...
SUSE CVE-2026-73073
Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...
EUVD-2026-63780
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
SUSE CVE-2026-73623
GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...
CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
EUVD-2026-63779
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
EUVD-2026-63741
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
EUVD-2026-63748
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...