426866 matches found
PT-2026-82661
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.run path, and subprocess.run. An unauthenticated attacker can explo...
PT-2026-82851
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
RockyLinux 10 : ruby (RLSA-2026:50778)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50778 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...
...[ More ]
Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...
Security update for rsync (important)
openSUSE security update: security update for rsync ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21650-1 Rating: important References: bsc1269039 bsc1269040 bsc1269041 bsc1269042 bsc1269043 bsc1269044 bsc1269045 bsc1269046 bsc1269047 bsc1269048...
Security update for rmt-server (important)
openSUSE security update: security update for rmt-server ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21640-1 Rating: important References: bsc1261388 bsc1261398 bsc1261406 bsc1261417 bsc1261426 bsc1261436 bsc1261447 bsc1261458 bsc1261466...
Escargot 4.3.0-214-gfaee4437 Command Injection
An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...
PT-2026-82649
Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description An eval injection a...
SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3800-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3800-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues...
CVE-2026-35868
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
PT-2026-82543
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ip address parameter is embedded...
PT-2026-82570
The execute ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
PHP Composer -- Multiple vulnerabilities
Composer project reports: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Fixed command injection via malicious Perforce url GHSA-rvx4-ffvw-m9q3...
CVE-2026-35869
A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...
PT-2026-82567
Name of the Vulnerable Software and Affected Versions mcp-router versions prior to 0.6.3 Description The CLI serves its MCP aggregator on every network interface by default and only enforces authentication if explicitly requested by the operator. In the serve command located in...
TencentOS Server 3: vim (TSSA-2026:0916)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0916 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
RockyLinux 10 : ruby4.0 (RLSA-2026:50773)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50773 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...
TencentOS Server 3: dracut (TSSA-2026:0902)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0902 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
EUVD-2026-67272
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...
