CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-89066

CVE-2026-89066 is an OS command injection vulnerability in the task synthesis component of projen (versions before 0.103.0 ). Shell metacharacters present in project configuration values and repository file names are interpolated unsanitized into generated task definitions, allowing arbitrary com...

EUVD-2026-76151

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

EUVD-2026-76149

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-7863 OS Command Injection in TUBITAK BILGEM's Pardus Software

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-7863 OS Command Injection in TUBITAK BILGEM's Pardus Software

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-7863

CVE-2026-7863 is an OS command injection vulnerability in TUBITAK BILGEM's Pardus Software (versions before 1.0.5 ), caused by improper neutralization of special elements used in an OS command. The vulnerability is reachable via a local attack vector with low complexity , requires no privileges a...

THM-Billing

🛡️ TryHackMe: Billing Linux Privilege Escalation | Web Ex...

Exploit for CVE-2026-85706

CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local f...

ImpactSword

ImpactSword – Red Team Edition ImpactSword is an offensive se...

CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated proof-of-concept for CVE-2025-68937 : directory traversal via symlink dereferencing in Gitea and Forgejo template repository processing, leading to remote code execution. Any authenticated user no admin required can obtain a shell as t...

cve-2022-33891

CVE-2022-33891 Apache Spark Shell 命令注入漏洞 一个用于利用 Apache Spark Shell 命令注入漏洞的 Python POC。我看到网上有些其他 POC 看起来很可疑。这个简单且干净。 我并未发现此漏洞/利用方式。我只是想为社区制作一个安全的 POC ^.^ 影响版本 Apache Spark 3.0.3 及更早版本、3.1.1 至 3.1.2 版本、3.2.0 至 3.2.1 版本 漏洞组件 root@kitploit: http://localhost:8080/?doAs=命令注入位置 示例 root@kitploit:...

CVE-2026-8301

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: before 1.0.8...

CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the javakeystorepasswd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is...