Linux Distros Unpatched Vulnerability : CVE-2026-63317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5...

Linux Distros Unpatched Vulnerability : CVE-2026-15793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious,...

KLA91172 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Input can be exploited remotely to execute...

False Prophets: On the Security of World Models in Agentic Systems

Large language models now power autonomous agents capable of complex, multi-step tasks in different environments. Accurate and reliable execution of these tasks requires the agent to predict the results of its actions. Recent research proposes to enhance predictive capabilities via specially...

Linux Distros Unpatched Vulnerability : CVE-2026-64415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/swap: add condresched in swapreclaimfullclusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP...

Linux Distros Unpatched Vulnerability : CVE-2026-56624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH use...

Eval Injection

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Eval Injection via the main process in collocations.py when command-line arguments are passed directly to the eval function without proper...

Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selec...

Exploit for CVE-2026-64600

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Fram...

GHSA-J6G5-3HH3-PGW8 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

Oh My Posh: Arbitrary command execution via template injection in the path segment

Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression i...

GHSA-6XJ8-QV9J-XCJQ Oh My Posh: Arbitrary command execution via template injection in the path segment

Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression i...

GHSA-FWJX-9P69-H25H Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Summary Oh My Posh renders dynamic, potentially attacker-controlled strings the current directory name, Git commit metadata, environment variable values, command output into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject...

GHSA-Q53C-4PRM-W95Q Shescape: Home-directory disclosure in assignment context on Unix with Dash

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...

Shescape: Home-directory disclosure in assignment context on Unix with Dash

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on h...

Improper Encoding or Escaping of Output

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the escape or escapeAll process when used with the shell option set to Dash or when the default shell is Dash. An attacker can obtain the user's home...

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...

GHSA-W4HW-QCX7-56PR Shescape: Shell injection via unescaped parentheses on Windows with CMD

Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. javascript import as cp from...