EulerOS Virtualization 2.13.0 : samba (EulerOS-SA-2026-3237)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

mcp-stdio-shellguard v0.1.2

Part of theStudioMeyer MCP Stack — Built in Mallorca 🌴 · ⭐ if you use it mcp-stdio-shellguard Defense-in-depth bundle for MCP stdio servers. Wraps childprocess.exec/spawn with allowlist + sandbox + replay-detection, plus an AST audit CLI mcp-shellguard-audit that scans MCP server sources for...

mcp-recon

MCP Recon Secure, modular MCP server wrapping 7 pentesting...

prismsec

PrismSec 🔷 Secure, modular MCP server for pentesting tools...

SUSE CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898

CVE-2026-61898 is a shell injection in the Ubuntu-specific language helper scripts (save-to-pam-env , update-langlist ) shipped with accountsservice before version 23.13.9-8ubuntu7 . The user-controlled LANGUAGE entry in ~/.pam_environment is interpolated unescaped into a GNU sed replacement expr...

CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

CVE-2026-61898 accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

EUVD-2026-62860

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into...

CVE-2026-16875

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...

EUVD-2026-62865

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-16875

A local attacker with low privileges on IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 can inject shell metacharacters to execute arbitrary commands, scoring CVSS 7.8 (High). IBM's support page (https://www.ibm.com/support/pages/node/7283858) should be checked for available patches or workarounds.

CVE-2026-16875 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...

EUVD-2026-62873

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...

CVE-2026-16848

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to remote arbitrary command execution via improper neutralization of shell metacharacters in DHCP options. An unauthenticated attacker on an adjacent network can inject malicious shell characters through DHCP option fields, achieving full confid...

CVE-2026-16848 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...

CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-68560

Wekan (open-source kanban built with Meteor) is vulnerable to shell injection in models/fileValidation.js prior to version 9.75 . When an external antivirus scanner is configured, the uploaded file path is interpolated into the administrator-defined externalCommandLine at its {file} placeholder a...