Lucene search
+L

1141 matches found

RedHat Linux
RedHat Linux
added 2026/08/10 2:06 p.m.11 views

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

10CVSS6.3AI score0.01582EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/10 10:41 a.m.39 views

CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

9.8CVSS0.01221EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/10 10:41 a.m.52 views

CVE-2026-72589

An OS command injection vulnerability affects alseambusher/crontab-ui up to version 0.4.2. An unauthenticated remote attacker can trigger arbitrary system commands by importing a crafted crontab database file via POST /import, which accepts arbitrary .db files and overwrites the application datab...

9.8CVSS5.8AI score0.01221EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/10 10:41 a.m.11 views

CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

9.8CVSS5.9AI score
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/07 11:17 a.m.11 views

CVE-2026-15816

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

7.5CVSS5.3AI score0.00292EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/07 12:00 a.m.8 views

PT-2026-68894

Name of the Vulnerable Software and Affected Versions dracut affected versions not specified Description A flaw exists in the die error-handling function which writes messages into a shell script within the initramfs emergency-hook directory without proper shell-quoting. An attacker on the adjace...

7.5CVSS5.3AI score0.00292EPSS
SaveExploits0References48
EUVD
EUVD
added 2026/08/05 12:26 p.m.11 views

EUVD-2026-53369

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting: cmd = "cp ".formatsource, backuppath; retcode = os.systemcmd. The only pre-check o...

7.2CVSS5.7AI score0.00463EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/01 1:17 p.m.10 views

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

9.3CVSS0.00451EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/01 12:22 p.m.134 views

CVE-2026-67308

Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...

9.3CVSS6.2AI score0.00451EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/01 12:22 p.m.15 views

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

10CVSS6.2AI score0.00451EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:22 p.m.13 views

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

10CVSS6.2AI score0.00451EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/01 12:22 p.m.42 views

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

9.3CVSS0.00451EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/31 3:59 p.m.43 views

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

7.7CVSS0.00296EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/30 4:40 p.m.11 views

SUSE CVE-2026-54088

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplie...

9.3CVSS8.2AI score0.00764EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/07/30 2:31 p.m.13 views

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

6.6CVSS6.7AI score0.00997EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/30 2:31 p.m.19 views

EUVD-2026-50564

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check...

6.6CVSS5.8AI score0.00997EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/30 2:31 p.m.11 views

GHSA-XC5W-4V5W-7X65 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

6.6CVSS6.7AI score0.00997EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/28 8:33 p.m.10 views

EUVD-2026-50055

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

9.1CVSS6.3AI score0.01038EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/25 9:16 a.m.34 views

CVE-2026-16766

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

9.8CVSS0.01424EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/07/25 8:12 a.m.16 views

CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

5.9AI score0.01424EPSS
SaveExploits0References4
Rows per page
Query Builder