Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Clean up CPU timers before freeing them during exec. The commit 55e8c8eb2c7b “posix-cpu-timers: Store a reference to a pid instead of a task” introduced a mechanism to retrieve tasks by PID when deleting a CPU...

CVE-2026-90619

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

EUVD-2026-77178

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-90619

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04 ) is affected by an OS command injection in the Execute Endpoint of the file hexstrike_server.py . An unauthenticated remote attacker can manipulate the code/script argument to inject arbitrary OS commands. The proof-of-con...

CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2022-39196-

CVE-2022-39196 Black board CMS 权限提升 Blackboard Learn 1.10.1 版本允许远程认证用户通过输入学生凭证并直接访问特定 webapps/bbcms/execute/ URL 来读取非预期的文件。 附加信息 root@kitploit: 步骤1：使用学生凭证权限。用户名： 及密码： 进行登录。 步骤2：使用"学生"账户权限成功登录后。 步骤3：然后请求"漏洞的URL/位置"。 步骤4：无需任何权限要求，直接将会话从"学生"提升为"竞赛管理系统"权限。 漏洞类型 root@kitploit: 敏感数据泄露 产品供应商...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

MAL-2026-15910 Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

CVE-2026-14673

An untrusted search path vulnerability in PostgreSQL's amcheck module allows a user with EXECUTE privileges to escalate privileges or execute arbitrary code. By setting a malicious search path before invoking an amcheck function, an attacker can hijack execution to run arbitrary SQL functions wit...

CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

EUVD-2026-68446

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, causing untrusted reconciliation input to be treated as trusted. An attacker can supply malicious execute plans that bypass security checks and perform unsafe reconciliation oper...

CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82267

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

EUVD-2026-67807

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

EUVD-2026-67798

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...