Exploit for Incomplete List of Disallowed Inputs in Fastgpt

fastgpt-sandbox-audit FastGPT Python sandbox escape chain aud...

MINI-85HR-X3GC-PMHF

Bulletin has no description...

CVE-2026-42018

creationtimestamp| type| source ---|---|--- 2026-08-18 06:52:55+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mtdmybk5rd2b 2026-09-11 08:57:22+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mva74qcuco2s 2026-09-11 10:07:47+00:00| seen|...

CVE-2026-16987

creationtimestamp| type| source ---|---|--- 2026-08-18 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtdm3ydyfa2h...

PT-2026-77156

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the must-gather component allows the cluster Proxy object to be dumped in raw form. This process bypasses the oc inspect redaction mechani...

Linux Distros Unpatched Vulnerability : CVE-2026-72429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This d...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

CVE-2026-67967

Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...

MINI-69FM-2RHW-M5RQ

Bulletin has no description...

MINI-QMJ2-G5FW-P3VF

Bulletin has no description...

MINI-V338-PCRV-3VJG

Bulletin has no description...

MINI-QMHJ-2M4Q-577F

Bulletin has no description...

MINI-GH32-J5QH-G46H

Bulletin has no description...

MINI-JQ2R-HWP2-2JQ8

Bulletin has no description...

MINI-5MPQ-6VRC-3795

Bulletin has no description...

MINI-RG7M-GQ48-VV2H

Bulletin has no description...

GHSA-59FJ-M2J6-HCXH Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

GHSA-73WF-9VMV-5PV9 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...