CVE-2026-76341

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a "power"-role user can store attacker-controlled SPL in a Table Editor dataset; when an "admin" opens it, the SPL runs with admin privileges, exposing all relevant data. The root cause is the Table Editor not applying SPL safeguards ...

CVE-2026-76341 Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

CVE-2026-76253

Any user with the schedule_search capability can execute arbitrary SPL commands at system level, reading all stored credentials. Splunk advisory SVD-2026-0801 documents fixes in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation details are not provided in the documents.

CVE-2026-75616

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-16882

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-76231

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

EUVD-2026-62411

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

EUVD-2026-62465

ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...

CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

CVE-2024-58376

Renovate versions 37.158.0 through 37.198.0 are affected by a command injection vulnerability in the helmv3 manager's registryAliases handling. Since PR #26848 made registryAliases mergeable, the helmv3 manager executes helm repo add for each defined alias. The key was not quoted , allowing att...

EUVD-2024-55728

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

BIT-POSTGRESQL-2026-6470 PostgreSQL fails to check type USAGE privilege

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL...

PT-2026-78769

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store risky Search...

SUSE CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

ALPINE-CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75854

ArcadeDB versions before 26.8.1 expose a missing authentication flaw in the Redis wire-protocol plugin. Network attackers can connect to the Redis port with no credentials and read, write, or delete data across any server database, scoring CVSS 9.8 (CRITICAL). No exploitation evidence is provided...

conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

CVE-2026-74870 openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...