PT-2026-108156

Name of the Vulnerable Software and Affected Versions image optimizer Ruby gem versions 1.3.0 through 1.9.0 Description An OS command injection flaw exists in the identify format function. This occurs when the identify option is enabled, allowing attackers to execute arbitrary commands by providi...

shell-quote npm Code Execution

The vulnerability of the quote function in the shell-quote npm package is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2026-92804

Docling has arbitrary file read/write and command execution when shell-escape is enabled when rendering untrusted TikZ with the opt-in Tectonic engine...

GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

SUSE CVE-2026-101258

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

ish

iSH Un proyecto para ejecutar un shell de Linux en iOS, utilizando emulación x86 en modo usuario y traducción de llamadas al sistema. Para el estado actual del proyecto, consulta la pestaña de issues y los registros de commits. Página de App Store Beta de TestFlight Servidor de Discord Wiki con...

EUVD-2026-93571

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable...

Security Bulletin: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution (CVE-2026-9764)

Summary IBM Bob could allow a remote attacker to execute arbitrary code when a user opens an untrusted repository in Bob Shell. Due to insufficient validation of workspace-provided MCP server configurations, MCP servers defined within the repository could be automatically executed without explici...

ace-vim-neovim

ace-vim-neovim Ejecución de código arbitrario en Vim/Neovim mediante modelines CVE-2019-12735 Uso 1. escucha nc -vlp 9999 2. ejecuta vim pocshell.txt Y entonces, tu localhost obtendrá una shell...

CLSA-2026-1791359284 TuxCare security update for shell-quote (1 CVE)

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

PT-2026-116388

TuxCare rebuilt shell-quote to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

CVE-2026-106059: Improper Neutralization of Special Elements used in an OS Command

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

Linux Distros Unpatched Vulnerability : CVE-2026-101258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell...

CLSA-2026-1791331076 rsync: Fix of 5 CVEs

CVE-2026-53790: refuse a shell-active RSYNCCONNECTPROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments - CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, changedir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved...

DEBIAN-CVE-2026-101258

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

CVE-2026-101258

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

[SECURITY] [DSA 6548-1] node-shell-quote security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...

CVE-2026-101258 Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...