193454 matches found
Dokploy 0.29.12 Compose Branch Command Injection
Dokploy versions 0.29.3 through 0.29.12 contain a command injection vulnerability in compose branch fields. This proof of concept demonstrates authenticated arbitrary command execution through compose deployment. https://packetstorm.news/download/236749...
PT-2026-120898
This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...
SMG Software Information Portal Shell Upload / Command Injection
SMG Software Information Portal versions prior to 13.06.2025 contain an unrestricted dangerous-file upload and OS command injection vulnerability...
OnePlus OxygenOS command injection vulnerability
A security vulnerability exists in OnePlus OxygenOS versions prior to 16.1.0 through 16.1.10.500, 16.0.0 through 16.0.5.1200, and 15.0.0 through 15.0.0.2000. This vulnerability arises because the atlasservice binder interface permits unauthorized acceptance of setEvent calls. Additionally, the...
ALSA-2026:86971 Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...
RHEL 10 : lrzsz (RHSA-2026:86056)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...
FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gdb (UTSA-2026-142302)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142302 advisory. A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separate...
PT-2026-120287
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...
SUSE CVE-2026-112177
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the seed mechanism's console script launcher rewriting logic in pipinvoke.py on POSIX systems. When a virtual environment is created and pip installs packages with console scripts, the interpreter path embedded in...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...
AZL-110091 CVE-2026-113732 affecting package python-virtualenv 20.36.1-9
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
DEBIAN-CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-9
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
DEBIAN-CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-9
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...