EUVD-2026-101836

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...

CVE-2026-110925

Removed by vendor...

pfsense-wireless-clone

abraxaslabs.tech · github.com/abraxas ·&...

ac-solver (0.1.0), accli (0.7.4) +996 more potentially affected by CVE-2026-110855 via gitpython (>=3.0.0, <=3.1.62)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.0.1, =0.1.8, =0.87.2.dev9, =0.5.0, =0.86.2 and more Source cves: CVE-2026-110855 Source advisory: SNYK:PYTHON-GITPYTHON-21246263...

CLEANSTART-2026-SW67186 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

CVE-2026-102422 affects multiple packages. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. See references for individual vulnerability details...

CVE-2026-111134: Out-of-bounds Read

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files,...

PT-2026-115140

Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260522 Description A heap out-of-bounds read occurs in the libfwsi mtp file entry values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP file...

Model-As-A-Trojan: Self-Activating Covert DNS Exfiltration Baked into the Weights of an LLM Agent

Open-weight models are downloaded from public hubs and run inside agent harnesses that grant them tools, most powerfully, a shell, under the assumption that a sandbox contains whatever the model might do. This paper demonstrates that the assumption has a blind spot: the weights themselves can be...

PT-2026-114767

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...

UBUNTU-CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110925

Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...

CVE-2026-111135: Out-of-bounds Read

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump li...

...[ More ]

Vesta Control Panel VestaCP versions up to and including 0.9.8-26 contain an OS command injection vulnerability in the configuration parsing functionality. The shared shell library uses unsafe eval operations to process user-controlled configuration values, allowing an authenticated hosting accou...

PT-2026-115141

Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260523 Description A heap out-of-bounds read occurs in the libfwsi mtp volume values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP volume she...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload flaw that can result in PHP code execution. The included proof of concept demonstrates the issue with a GIF/PHP marker polyglot. https://packetstorm.news/download/235859...

Linux Distros Unpatched Vulnerability : CVE-2026-110925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non- trailing backslash. When a configuration expands %u insi...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-130387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130387 advisory. Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an...

CVE-2026-86002

The Dokku platform as a service (versions before 0.38.25 ) is vulnerable to arbitrary command execution. A user with app-level access and remote SSH access capable of executing docker-options commands can store arbitrary strings via the docker-options plugin . These strings are concatenated into ...

Command Injection

Overview xhtml2pdf is a PDF generator using HTML and CSS Affected versions of this package are vulnerable to Command Injection in the startViewer function in xhtml2pdf/pisa.py, whose fallback path interpolates the file name into a shell string as os.system'open "%s"' % filename after os.startfile...