41493 matches found
CVE-2026-53790: Improper Neutralization of Special Elements used in an OS Command
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
CVE-2026-67614: Use of Hard-coded Credentials
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...
dracut security update
057-120.git20260728.0.1 - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. Orabug: 38705580 - Ship Oracle IMA certificate Orabug: 35992862 - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate Orabug: 35992862 -...
PT-2026-71628
Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Multiple command and argument injection issues allow attackers to execute arbitrary commands by providing malicious input through various code paths. These paths include the RSYNC CONNECT PROG...
Tenable Security Center SCAP Audit File Command Injection
Tenable Security Center prior to 6.9.0 allows an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. Filesystem::saveTmp builds staged upload filenames from the raw client-supplied context form parameter tempnam prefix, which is not...
CVE-2026-49481
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
EUVD-2026-57694
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49481
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
Improper Encoding or Escaping of Output
Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper escaping in the getEscapeFunction function. An attacker can access sensitive home-directory information and potentially alter the target...
@rse/claudex (>=0.9.22, <=1.0.10), @snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.1) +6 more potentially affected by CVE-2026-73412 via shescape (>=2.1.0, <=2.1.12)
shescape NPM version =2.1.0, =0.9.22, =2.6.0, =2.0.0, =8.0.0, =6.0.0, =3.0.0, =3.0.0, =3.1.2 Source cves: CVE-2026-73412 Source advisory: SNYK:JS-SHESCAPE-18752072...
Command Injection
Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Command Injection in the escape and escapeAll functions when used on Unix systems with the shell explicitly configured to Zsh, or when the default shell is Zsh. An attacker can obtain lists of...
@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by CVE-2026-73413 via shescape (>=2.1.11, <=2.1.12)
shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: CVE-2026-73413 Source advisory: SNYK:JS-SHESCAPE-18752068...
Malicious code in internallib_v756 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9f2ca94c3bf4bd18f73321d08c08130180a3bb66237a4f05f326d0adcf6e06 index.js the package main entry synchronously invokes execSync to spawn /bin/bash -i with stdio redirected through /dev/tcp/10.0.74.63/4444, opening ...
MAL-2026-13928 Malicious code in internallib_v756 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9f2ca94c3bf4bd18f73321d08c08130180a3bb66237a4f05f326d0adcf6e06 index.js the package main entry synchronously invokes execSync to spawn /bin/bash -i with stdio redirected through /dev/tcp/10.0.74.63/4444, opening ...
GHSA-5XVQ-CP9X-6P6R vulnerabilities
Vulnerabilities for packages: yazi...
CVE-2026-68930 vulnerabilities
Vulnerabilities for packages: yazi...
CVE-2026-73411
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...
CVE-2026-73412
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...
CVE-2026-73414
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...