CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

EUVD-2026-64011

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh . Usernames and home directories read from /etc/passwd are substituted directly into command strings without escaping before execution via ...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

EUVD-2026-64010

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41450

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function. The root cause is that foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with e...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 are affected by a command injection vulnerability in the _run_command function. The root cause is the failure to sanitize untrusted data—such as usernames, process names, or filenames—before passing it to shell execution, allowing attack...

EUVD-2026-64009

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

Exploit for CVE-2026-58455

CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass +...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.2 Vulnerability Details CVEID:CVE-2022-40152 DESCRIPTION: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user suppli...

CVE-2026-77087

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...