193601 matches found
CVE-2026-111876 alexpasmantier television entry.rs output command injection
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...
CVE-2026-111876 alexpasmantier television entry.rs output command injection
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...
PT-2026-117033
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the NVMe subsystem. This occurs when an I/O passthrough command is sent through a multipath namespace head after the controller path that initially creat...
Linux Distros Unpatched Vulnerability : CVE-2026-98828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting...
CVE-2026-111876: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...
WordPress the Grid 2.8.1 Command Injection
WordPress The Grid plugin versions through 2.8.1 contain a code injection vulnerability that allows command injection...
PT-2026-116544
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...
CVE-2026-98828: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...
Exploit for Deserialization of Untrusted Data in Roundcube Webmail
CVE-2025-49113 — ROUNDMAIL INCIDENT Roundcube PHP 객체 역직렬화 R...
WSO2 Enterprise Integrator command injection vulnerability
WSO2 Enterprise Integrator has a command injection vulnerability. This vulnerability stems from improper input validation in the Management Console’s handling of JDBC user storage configurations. It may allow attackers to execute arbitrary code on affected servers with WSO2 product privileges...
Alex Pasmantier Television: Input validation error vulnerability
Alex Pasmantier’s Television software versions prior to 0.15.9 contain security vulnerabilities. These vulnerabilities stem from incorrect handling of the raw parameter in the function Entry::output defined in the file Television/channels/entry.rs. This could lead to command injection attacks,...
openssh: Fix of 4 CVEs
CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...
CLSA-2026-1792078892 openssh: Fix of 4 CVEs
CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...
CLSA-2026-1792242216 ruby: Fix of CVE-2026-42246
CVE-2026-42246: fix Net::IMAPstarttls returning success without TLS on a man-in-the-middle error response - CVE-2026-42258: fix IMAP command injection via Symbol arguments...
CLSA-2026-1792158099 openssh: Fix of 4 CVEs
CVE-2026-106555: reset GSSAPI client state before each authentication attempt upstream 670510d1 - CVE-2026-106553: store delegated GSSAPI credentials only after successful authorization upstream 6f9cd19a - CVE-2026-106583: disallow '$' and '' in a command-line user name upstream 0c4c9a7b -...
OffensiveQueries
OffensiveQueries injection payloads cheat sheet I keep on...
MGASA-2026-0515 Updated curl package fixes security vulnerabilities
curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...
Updated curl package fixes security vulnerabilities
curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set...
CVE-2026-111853
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...
CVE-2026-111853
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...