[SECURITY] [DLA 4846-1] git-lfs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4846-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler October 21, 2026 https://wiki.debian.org/LTS -...

MCPJam Inspector 1.4.2 Remote Command Execution

MCPJam Inspector version 1.4.2 and earlier contains a remote command execution vulnerability. The proof of concept sends a crafted server configuration to the MCP connection endpoint. https://packetstorm.news/download/236732...

Debian dla-4846 : git-lfs - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4846 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4846-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-112380

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...

EUVD-2026-105278

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...

CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...

CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To...

CVE-2026-112380

The Kiro Crew software is vulnerable to missing authorization in the WhatsApp group channel. This flaw allows a remote actor who is a member of an operator-configured WhatsApp group to send messages that take control of the operator's other agent sessions. Consequently, the attacker may be able t...

PT-2026-118635

Name of the Vulnerable Software and Affected Versions Kiro Crew versions prior to 0.7.2 Description Missing authorization in the WhatsApp group channel allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions of the operator. This occurs becau...

CVE-2026-76740 HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

CVE-2026-76740 HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

CVE-2026-76740

A security vulnerability exists in HPE Compute Scale-up Server 3200 and 3250 platforms , as well as Superdome Flex and Superdome Flex 280 servers , allowing for Remote Command Execution on the RMC. The root cause is identified as CWE-78 (OS Command Injection) . Attackers with high privileges can ...

EUVD-2026-104091

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

MAL-2026-17927 Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

PT-2026-117495

Name of the Vulnerable Software and Affected Versions Eptura Archibus versions prior to 2025.02 Description An unauthenticated arbitrary file upload issue allows attackers to upload files with any content, including JSP and JSPX scripts, via the export reports feature. Because these uploaded file...

Satya-Vinay Events-Management-System Input Verification Vulnerability

Satya-Vinay Events-Management-System has a security vulnerability. This vulnerability stems from improper handling of parameters in the dodelete.php file within the Registration-Delete Handler component. It may lead to SQL injection attacks, and attackers could execute commands remotely...

Radare2 processing logic error vulnerability

Radare2 versions 6.2.0 and 6.2.2 have a processing logic vulnerability. This vulnerability stems from the operation of the rcorecmdstrpipe function in the libr/core/rtrhttp.inc.c library within the HTTP Sandbox Policy Handler component. This operation causes the protection mechanism to fail,...

GNU Bash 4.3 Remote Command Execution

GNU Bash versions through 4.3 contain a flaw that allows crafted environment variables passed to CGI scripts to execute commands. This proof of concept sends a malicious User-Agent header to demonstrate the issue. https://packetstorm.news/download/236107...

CVE-2026-55453

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quotestring function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before reportattr writes the value to the...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. No users are affected as long as they follow...