GO-2026-6358 OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

SummaryGitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist ingit/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is thischeck him he is only call from fetch, pull, push and clonefrom, everything else who build a gitargv from...

CVE-2026-73694: Improper Neutralization of Special Elements used in an OS Command

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

PT-2026-89497

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

Exploit for Server-Side Request Forgery in Openclaw

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy B...

MAL-2026-16052 Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

Linux Distros Unpatched Vulnerability : CVE-2026-80777

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is t...

CVE-2026-67279

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

EUVD-2026-72027

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

CVE-2026-67279

The MikroTik RouterOS SSH server is vulnerable to an authentication bypass (CVE-2026-67279) where a client-requested rekey before authentication triggers the server to enter the connection protocol without verifying user credentials. This allows unauthenticated clients to open session channels an...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

SUSE CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

SUSE CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

PT-2026-86454

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 Long-term RouterOS versions prior to 7.23.4 Long-term RouterOS versions prior to 7.24.2 Stable Description The SSH server improperly enforces the behavioral workflow during a client-requested rekey. This allo...

CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777

CVE-2026-80777 is a race condition in the Linux kernel's futex/pi subsystem. During exec() , there is a window between setting a task's futex exit state to OK and actually swapping its memory map (mm), during which the check comparing a waiter's mm against the owner's mm can return an incorrect r...

CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

EUVD-2026-71420

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...