CVE-2026-38755

A heap overflow in the evalcommand function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

PT-2026-60317

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.07 Description The avatar upload functionality allows the embedding of user-supplied filenames into paths that are subsequently passed to the child process.exec function for MIME-type detection. Specifically, the...

CVE-2026-38754

A heap overflow in the ifsbreakup function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

CVE-2026-38754

A heap overflow exists in the ifsbreakup() function (located in shell/ash.c ) of Busybox v1.38.0 . An attacker can exploit this vulnerability by supplying crafted input to trigger a Denial of Service (DoS) . Impacted versions include those reported by various distributions; for instance, CBL-Mari...

PT-2026-60313

Name of the Vulnerable Software and Affected Versions Busybox version 1.38.0 Description A heap overflow occurs in the ifsbreakup function located in shell/ash.c. This issue allows attackers to cause a Denial of Service DoS by providing a specially crafted input. A heap overflow is a memory...

CVE-2026-38754

A heap overflow in the ifsbreakup function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

RockyLinux 9 : libxml2 (RLSA-2026:39317)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39317 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-55576: Improper Neutralization of Special Elements used in an OS Command

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...

📄 xxl-job Cross Site Request Forgery

xxl-job versions prior to 3.4.0 suffer from a cross site request forgery vulnerability. Description Summary A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The...

CVE-2026-15921: Improper Limitation of a Pathname to a Restricted Directory

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts parse the node.js mirror's index.tab and use each release's LTS...

RockyLinux 10 : libxml2 (RLSA-2026:39304)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39304 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from t...

AlmaLinux 10 : libxml2 (ALSA-2026:39304)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39304 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-38755: Uncontrolled Recursion

A heap overflow in the evalcommand function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

PT-2026-60330

Name of the Vulnerable Software and Affected Versions xxl-job-admin version 3.0.0 Description A Cross-Site Request Forgery CSRF issue exists in the web application. This occurs because a specific endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods through a permissive...

CVE-2026-52891: Improper Neutralization of Special Elements used in an OS Command

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to childprocess.exec for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename...

CVE-2026-26718: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

CVE-2026-38754

A heap overflow in the ifsbreakup function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

CVE-2026-38755

A heap overflow in the evalcommand function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input...