CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

EUVD-2026-57518

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

EUVD-2026-57517

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17417

CVE-2026-17417 affects IBM i versions 7.3–7.6. It enables a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in Resource Monitoring and Control. CVSS 3.1 base score 8.8 (NETWORK/LOW, PRIVILEGES REQUIRED: LOW, USER INTERACTION: NONE...

secbutler v0.2.3

Essential utilities for pentester, bug-bounty hunters and security researchers Features • Usage • Installation • License • secbutler is a utility tool made for pentesters , bug-bounty hunters and security researchers that contains all the most used and tedious stuff commonly used while performing...

CVE-2026-48554 Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the comdata parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

CVE-2026-48554

CVE-2026-48554 affects Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7). An authenticated remote code execution flaw exists via unfiltered NOTIFICATION-family macro substitution in the com_data parameter. If a notification command uses $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

CVE-2026-48553

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor NRDP. When a custom variable defined on a host, service, or contact is referenced in a shell-executed command...

Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e The package advertises itself as an n8n utility helper and registers a trivial stub node nodes/PwnNode.node.js, but its postinstall lifecycle script...

Malicious code in @years19/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16 The package's postinstall script and its main entrypoint index.js, byte-identical to callback.js fetch four tarballs mhddos, PyRoxy, impacket,...

MAL-2026-13899 Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

MAL-2026-13882 Malicious code in verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b package.json declares preinstall: node index.js, which runs automatically on npm install. index.js shells out via childprocess and curl to POST the...

CVE-2026-72913

A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences @kitty-echo and @kitty-ssh when a user displays untrusted terminal data. These sequences write unauthenticated data to th...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

MAL-2026-13872 Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...