45424 matches found
CVE-2026-68518
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...
PYSEC-2026-3770
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
PYSEC-2026-3770
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
PYSEC-2026-3753
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
PYSEC-2026-3753
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74873
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
EUVD-2026-60114
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74895
openssl_encrypt (Python package) versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution, allowing attackers to run malicious plugins with unrestricted filesystem, network, subprocess, and Python module access (CVSS 9.8 CRITICAL). No in-...
CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74873
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74873
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
EUVD-2026-60092
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74873
The openssl_encrypt tool (before v1.4.0) passes --password values as visible process arguments, retrievable by any local user via ps aux or /proc/[pid]/cmdline, exposing plaintext and keystore passwords. CVSS 5.5 (local) / 8.7 (network). Upgrade to v1.4.0 or pass passwords via stdin/env instead o...
CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...
CVE-2026-74802
SiYuan versions before 3.7.4 set the WebSocket CheckOrigin handler to unconditionally return true on the admin-only /ws/network/proxy endpoint, allowing cross-site WebSocket hijacking. A malicious webpage can make the victim's SiYuan kernel proxy arbitrary network traffic, enabling authenticated ...
BIT-NODE-MIN-2026-58042
A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...