CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858

In CodeWhale (codewhale/codewhale-tui) versions 0.8.41–0.8.63, rlm_eval's approval_requirement() returns ApprovalRequirement::Auto, causing the engine to execute arbitrary model-supplied Python code without consulting the user's --approval-policy or prompting for approval. An attacker can trigger...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

EUVD-2026-60965

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

DEBIAN-CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

nmap-vulners v1.5

nmap-vulners Turn an nmap service scan into a list of CVEs, CVSS scores and known exploits. Three NSE scripts that take the software nmap already identified, ask the Vulners database what is known about it, and print the answer inside the scan report. The three scripts Script| Needs a key| What i...

diaphora v3.4.2

δiaphora Installation Install with the Hex-Rays plugin manager: root@kitploit: hcli plugin install https://github.com/joxeankoret/diaphora/archive/refs/tags/3.4.2.zip Manual install instructions are below. Diaphora διαφορά, Greek for 'difference' version 3.4 is the most advanced program diffing...

GO-2026-6145 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin...

GO-2026-6248 uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli

uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli...

GO-2026-6108 Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh

Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh...

EUVD-2026-60823

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey (distributed key-value DB) has a use-after-free in the RESTORE command's RDB stream consumer-group deserialization: a malformed payload assigns one Pending Entry List NACK to multiple consumers, and deleting one while another references it can lead to remote code execution (CVSS 8.8 HIGH, ...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...