CLEANSTART-2026-NW20382 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

Security vulnerability affects the cri-tools package. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", "...

PT-2026-105590

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23919)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523919 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride FileInfo...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2025_23732)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523732 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 modmd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-557...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2026:1784074201)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784074201 advisory. - Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with...

Rocky Linux 10.1 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23932)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523932 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride...

CLEANSTART-2026-MQ70542 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

Security vulnerability affects the buildkitd package. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", "...

EUVD-2026-90257

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

PT-2026-103519

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incomplete environment-variable sanitizer in the system.run function fails to block specific variables. Attackers with gateway or agent access can supply GIT CONFIG , DOTNET START...

CVE-2026-101884: Incomplete List of Disallowed Inputs

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: sudo (UTSA-2026-126151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126151 advisory. A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator,...

CVE-2026-102829

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2026-102829

The simple-git library, which allows Node.js applications to execute Git operations, is vulnerable due to a flaw in the argv-parser package prior to version 2.0.1 . The parseEnv function omits VISUAL from GitEnvKeys, causing prepareEnv to drop the value before vulnerabilityCheck can identify it a...

CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

CVE-2014-6271-EXPLOIT

CVE-2014-6271 - Shellshock 💣 Shellshock는 GNU Bash 셸의 치명적인 취약점입니다. 버전 4.3까지 영향을 미치며, 원격 공격자가 임의의 코드를 실행할 수 있도록 합니다. 이 취약점은 Bash가 환경 변수 값에서 함수 정의 뒤에 오는 문자열을 처리하는 방식에서 발생합니다. 🔍 상세 설명 Shellshock 취약점은 공격자가 특수하게 조작된 환경 변수를 통해 코드를 주입하고 실행할 수 있게 합니다. 이러한 변수는 다양한 경로를 통해 설정될 수 있습니다: OpenSSH의 sshd에 있는...

SUSE CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...