Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via path interpolation in the generated activate.sh bash and activate.fish fish activation scripts. When a virtualenv is created with a path containing shell metacharacters, those characters are embedded unquoted into...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the BatchActivator.quote method in src/virtualenv/activation/batch/init.py, which previously returned its input string unchanged. When a virtualenv is created in a path containing cmd.exe operator characters such a...

CVE-2026-102904

A flaw was found in JupyterLab. When processing extension uninstallation requests, user-supplied package names are passed to the underlying package manager without properly filtering command-line options. An authenticated user with extension management access can exploit this argument injection...

Security Bulletin: EDB Postgres AI Database with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI database products. Hence, IBM strongly recommends upgrading to 18.6 Vulnerability Details CVEID:CVE-2026-30922 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

Phishing Abuses RMM Tools for Persistent Access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management RMM installer...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the blockUnsafeOperationsPlugin, which fails to block dangerous git options such as --upload-pack, --receive-pac...

Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via the rebase command handler and the trailer..cmd/trailer..command configuration keys, which allow an attacker to inject the...

Security Bulletin: InfoSphere Data Replication - Data Replication for Availability is affected by arbitrary code execution, cross-site scripting, and denial of service

Summary IBM has released the below fix for IBM InfoSphere Data Replication - Data Replication for Availability Db2U Qreplication container in response to multiple vulnerabilities. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2026-33916...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the detect-vulnerable-config-writes path in the argv-parser package, where unsanitised arguments passed to git...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded befor...

resterm v1.10.2

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is an API client that uses .http/.rest files as source code. Almost all the features live in .http files, so they are easy to review in Git or any other version control. You can send requests, test API flows, record HTT...

Exploit for PHP Remote File Inclusion in Wordpress

⚡ XWPRCE — CVE-2026-87902 Hacker Console WordPress Core g...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-76737

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...

CVE-2026-76724

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-76727

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...