CVE-2026-73498 vulnerabilities

Vulnerabilities for packages: mcp-atlassian...

CVE-2026-19747

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carri...

CVE-2026-18164

creationtimestamp| type| source ---|---|--- 2026-08-13 20:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01...

CVE-2026-73650

creationtimestamp| type| source ---|---|--- 2026-08-13 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msygo65aqv2u 2026-08-13 20:35:07+00:00| published-proof-of-concept| https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545...

EUVD-2026-58370

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carri...

CVE-2026-19747

The CVE-2026-19747 entry identifies a vulnerability in Tenda devices (CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C, TC3T15C) affecting the ATE Module’s Kylin component, specifically the CAte::HandleCmd function. This manipulation enables remote command injection, implying a netwo...

CVE-2026-19747

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carri...

CVE-2026-19747 Tenda CH7 ATE Module Kylin HandleCmd command injection

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carri...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via unsanitized input in several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. An attacker can execute arbitrary...

CVE-2026-18370

A flaw was found in entr. A local attacker can exploit a heap-based buffer overflow in the runutility function by supplying specially crafted command-line arguments or using the / substitution feature. This can lead to memory corruption, causing a process abort and a denial of service DoS...

CVE-2026-25589

A flaw was found in RedisBloom. An authenticated attacker with permission to execute the RESTORE command on a Redis server with the RedisBloom module loaded can supply a crafted serialized payload that causes an invalid memory access due to an improper validation of serialized values processed...

SUSE CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the \unrestrict meta-command input expansion in the restore process. An attacker can execute arbitrary code as the client operating system account by injecting malicious input from a compromised origin...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the COPY FROM STDIN process. An attacker can execute arbitrary commands by injecting specially crafted data lines when an early failure occurs before the server signals readiness for input rows. This is...

CVE-2026-73505

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...

CVE-2026-65932

The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below...

ALPINE-CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

AZL-95834 CVE-2026-53790 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...