CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

CVE-2026-16022

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

CVE-2026-71243

The CVE-2026-71243 entry concerns the backmeup npm package. It vulnerably assembles shell command strings by concatenating option values (name, source, destination, filter) into a single command (e.g., mkdir -p ...; ) and executes via a shell (ssh2-exec or local child_process), instead of using a...

CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

CVE-2026-7693

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

Photon OS 5.0: Perl PHSA-2023-5.0-91-0054

An update of the perl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0054. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2024-5.0-91-0187

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Ansible PHSA-2026-5.0-91-0881

An update of the ansible package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Squid PHSA-2023-5.0-91-0154

An update of the squid package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0154. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Freetype2 PHSA-2026-5.0-91-0884

An update of the freetype2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0884. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Sudo PHSA-2026-5.0-92-0815

An update of the sudo package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0815. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-53505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs ...

Photon OS 5.0: Linux PHSA-2025-5.0-91-0705

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0705. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0917. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2024-5.0-91-0319

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0319. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-90-0862

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0862. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Docker PHSA-2026-5.0-91-0809

An update of the docker package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0809. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Glibc PHSA-2026-5.0-91-0857

An update of the glibc package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0857. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...