32895 matches found
CVE-2026-71567
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...
EUVD-2026-60193
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...
CVE-2026-74845
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845
CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
EUVD-2026-60077
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
PT-2026-76672
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...
PT-2026-76723
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure popen with shell operators enabled, allowing configured redirection, command chaining, or pipes t...
PT-2026-73433
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
CVE-2026-67966
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
EUVD-2026-60538
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
PT-2026-76810
Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...
CVE-2026-67966
The Tenda W20E V5.0 router (firmware V16.01.0.6(2782)) exposes /goform/telnet, which unconditionally starts telnetd and opens port 23 to the WAN, granting an unauthenticated, passwordless root shell. The flaw stems from manufacturing-test code retained in production firmware. No fix is available;...
SJ-GPS-PRO-F11-Vulnerability
Independent vulnerability research on the SJRC F11 series consum...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055 Shescape before 2.1.15 Home Directory Disclosure via BusyBox
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-73055
Shescape before 2.1.15 and 3.0.0 before 3.0.2 fails to properly escape tilde characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed...
CVE-2026-57062 vulnerabilities
Vulnerabilities for packages: gnupg...
PT-2026-73059
Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.15 Shescape versions 3.0.0 through 3.0.1 Description On Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox, the software fails to properly escape tilde characters ...
