PT-2026-108378

Security vulnerability affects the argo-workflows package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

CVE-2026-102422: Improper Neutralization of Special Elements used in an OS Command

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

Linux Distros Unpatched Vulnerability : CVE-2026-54875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms...

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

USN-8839-1 atril vulnerabilities

It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code. CVE-2026-46529 It was discovered that Atril incorrectly handled certain PDF file...

Security update for glib2

This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively y...

SUSE-SU-2026:4367-1 Security update for glib2

This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

EUVD-2026-88165

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-86530

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-84657

A flaw was found in Jenkins. The build command-line interface CLI does not properly enforce permissions when canceling a build. An attacker with Item/Build permission can exploit this by using the -s flag to cancel builds initiated by other users, leading to unauthorized disruption of ongoing...

PT-2026-99812

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi products affected versions not specified Description BUFFALO Wi-Fi products improperly handle input from web forms when assembling internal command line strings. This allows an administrative user to execute arbitrary operating...

Trajectory-Level Security Debt in LLM Coding Agents

LLM coding agents can traverse hundreds of intermediate code states before submitting a solution. Evaluating only the final artifact leaves the evolution of security findings unmeasured. We introduce the Security Debt Line Integral SDLI, which accumulates static-analysis risk when an agent reache...

Microsoft Azure CLI Code Execution

The vulnerability of the Command Line Interface CLI of the Microsoft Azure platform is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-100566

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100566

OpenClaw LINE versions prior to 2026.8.1 are susceptible to an access control vulnerability . The issue arises because the group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. This allows attackers with group participation to trigger the age...

CVE-2026-100566

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...