CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

CVE-2026-72913 affects Kitty terminal (GPU-based, cross-platform) prior to version 0.48.2. The vulnerability arises from misbehavior in the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py, which write unauthenticated data to the child shell’s stdin. The handle_remote_echo path accepts ...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

EUVD-2026-55835

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

pt-esign__Damn-vulnerable-sca

SCA Goat Navigating SCA Vulnerabilities, Empowering Mastery...

pt-platform__java-goof-1

Java Goof A vulnerable demo application, initially based on...

pt-platform__container-breaking-in-goof

Goof - Snyk's application demo for breaking into containers P...

dts-data__damn-vulnerable-web-server

Damn Vulnerable Web Server Vulnerable Web Server written in...

pt-platform__DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

JLSEC-2026-1242 ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyzestring in progs/infocmp.c...

CVE-2026-72885

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2026-72884

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...