dvwa-rce-finding-chain

DVWA Finding Chain: Stored XSS to Persistent RCE A pentes...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

PT-2026-71173

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

PT-2026-71271

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of shell metacharacters. This occurs when the system fails to properly filter or escape special characters...

Linux Distros Unpatched Vulnerability : CVE-2026-73077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype...

DEBIAN-CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

UBUNTU-CVE-2026-5917

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as...

CVE-2026-5917 libgit2 Shell Command Injection via ssh_libssh2 Backend

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

EUVD-2026-56976

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-48120

A flaw was found in Kakoune, a code editor. A local attacker could exploit a vulnerability in the bundled autorestore.kak script by crafting malicious backup files. When a user simply opens a file, these malicious backup files can lead to the execution of arbitrary Kakoune and shell commands. Thi...

GHSA-54FX-42GC-7VW4 vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-F23P-VX2J-J53R vulnerabilities

Vulnerabilities for packages: langfuse...

Exploit for Insertion of Sensitive Information into Log File in Hitachi Configuration_Manager

FreePBX CVE-2025-57819 Exploit Description This script exp...

CVE-2026-73224

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

CVE-2026-73222

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

CVE-2026-70335

creationtimestamp| type| source ---|---|--- 2026-08-11 19:00:57+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 20:47:57+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0285 2026-08-12 01:00:53+00:00| seen|...

CVE-2026-73224 Electerm check folder size function may get attacked by unsafe folder name

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...