CVE-2026-69606: Use After Free

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-69383: External Control of File Name or Path

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-70563: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-69528: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-86713: Use After Free

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup deletes the LoadMon object and frees the performance counter before perfend attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop comma...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-82537: Interpretation Conflict

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82536: Incomplete List of Disallowed Inputs

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

PT-2026-87141

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

PT-2026-87748

Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network...

UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...

PT-2026-87429

Name of the Vulnerable Software and Affected Versions Windows Shell affected versions not specified Description A use-after-free condition in Windows Shell allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when an application...

EulerOS 2.0 SP12 : samba (EulerOS-SA-2026-3385)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

EulerOS 2.0 SP12 : samba (EulerOS-SA-2026-3310)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

NewStart CGSL MAIN 7.02 : httpd Vulnerability (NS-SA-2026-0094)

The remote NewStart CGSL host, running version MAIN 7.02, has httpd packages installed that are affected by a vulnerability: - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd=... directives...

EulerOS 2.0 SP12 : dracut (EulerOS-SA-2026-3332)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

CVE-2021-3156

CVE-2021-3156 Root shell PoC for CVE-2021-3156 no bruteforce For educational purposes etc. Tested on Ubuntu 20.04 against sudo 1.8.31 All research credit: Qualys Research Team Check out the details on their blog. You can check your version of sudo is vulnerable with: $ sudoedit -s Y. If it asks f...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected...

AZL-99986 CVE-2026-19843 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...