PT-2026-108295

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.5.3 Description An issue exists where an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting. This command li...

Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability

Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...

CVE-2026-106440

A flaw was found in hydra-optuna-sweeper. This vulnerability allows an attacker who controls sweep configuration settings or command-line overrides to achieve arbitrary code execution. The component dynamically resolves and invokes callable objects specified in user-controlled configuration paths...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

EUVD-2026-94104

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

AZL-106685 CVE-2026-106583 affecting package openssh 9.8p1-10

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583: Improper Control of Resource Identifiers

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...

CVE-2026-106583

In OpenSSH versions prior to 10.6 , a vulnerability exists where the presence of a $ or ** character in a command-line username can lead to injection . This issue is associated with CWE-99 (Improper Control of Resource Identifiers). Exploitation details are not provided in the documents, and spec...

CVE-2026-79800

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

USN-8892-1 wsl-pro-service vulnerability

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories...

CVE-2026-79800 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

CVE-2026-79800 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

EUVD-2026-93887

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

CVE-2026-79800

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager . A low-privileged authenticated remote attacker could exploit this flaw to achieve remote code execution with elevated privileges on the underlying operating system. No specific patch v...

GHSA-PQG4-J6R4-53MV shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...