libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2022-43671

creationtimestamp| type| source ---|---|--- 2026-09-01 17:00:24+00:00| seen| https://t.me/cissp/6361 2026-09-02 01:04:07+00:00| seen| https://t.me/cissp/6361...

CVE-2026-84153

A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The...

CVE-2026-79682

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 认证命令注入（CVE-2023-39362）漏洞应用程序 这是一个用于测试 Cacti 漏洞（CVE-2023-39362 ）攻击程序的漏洞应用程序。 警告！ 此应用程序包含严重的安全漏洞。运行风险自负！建议使用经过备份且隔离的环境（例如具有近期快照和仅主机网络（host-only networking）的虚拟机）。请勿将此应用程序上传到任何面向互联网的服务器，否则它们将被入侵。 免责声明 : 我对任何人使用此应用程序的方式不承担任何责任。此应用程序的唯一用途是作为 CVE-2023-39362...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-83618

A flaw was found in xmldom, a JavaScript XML parser and serializer module. A remote attacker could bypass the requireWellFormed strict-serialization mitigation for DocumentType injection by embedding line terminators within the publicId or systemId of a DocumentType declaration. This allows for t...

CVE-2026-83616

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58567

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

EUVD-2026-69302

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-83610

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. The Document.createEntityReference function incorrectly accepts invalid names, which are then directly emitted during serialization. This vulnerability allows an attacker to inject arbitrary XML fragments when an...

CVE-2026-83608

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted DocumentType.name containing characters like or whitespace. This bypasses the requireWellFormed validation, allowing the injection of...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...