PT-2026-107259

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

CVE-2026-101258: Out-of-bounds Write

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

PT-2026-106736

Name of the Vulnerable Software and Affected Versions Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator versions prior to 2.1 Description An OS command injection flaw exists in the shell-based temporary-file cleanup instructions. An attacker can execute arbitrary command...

Linux Distros Unpatched Vulnerability : CVE-2026-102828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...

CVE-2026-105788: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-101258: Out-of-bounds Write

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

CVE-2026-106106: Improper Neutralization of Input During Web Page Generation

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-94293: Missing Authentication for Critical Function

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

An input validation and command injection vulnerability exists in the firmware download and upgrade component of Brocade Fabric OS

: Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-105793: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

PT-2026-107229

Name of the Vulnerable Software and Affected Versions Ghostscript versions 10.00.0 through 10.07.1 Description A flaw exists when rendering crafted PostScript or EPS documents, allowing a bypass of the -dSAFER sandbox. This is achieved by chaining memory corruption during document parsing with th...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

EUVD-2026-91767

@nx/docker: OS command injection in the @nx/docker release pipeline...

@nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

Directory Traversal

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Directory Traversal via the TectonicEngine class in...

PYSEC-2026-4191

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

PYSEC-2026-4191

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

CVE-2026-105744

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

CVE-2026-105744 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...