Command Injection

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

TomcatScanPro

tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含...

USN-8857-1 kf6-kcoreaddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

USN-8857-1: KCoreAddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

CLEANSTART-2024-BU71046 It was discovered that the gnome-shell lock screen since version 3

Security vulnerability affects the gnome-shell package. It was discovered that the gnome-shell lock screen since version 3...

MSC-2026-12540

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12615

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12607

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CLEANSTART-2024-TT19633 Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103

Security vulnerability affects the chromium package. Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103...

MSC-2026-12452

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

PT-2026-103915

Name of the Vulnerable Software and Affected Versions rubygem-foreman remote execution affected versions not specified Description A command injection flaw exists in the Red Hat Satellite API endpoint '/api/v2/job invocations'. The issue occurs when a job template has the effective user property...

CVE-2026-51881

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment...

PT-2026-104017

Name of the Vulnerable Software and Affected Versions Kasa EC70 v4 Kasa EC71 v4 Description The production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. An attacker with physical access can restore physically severed debug traces to...

PT-2026-110336

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Public INPUT RECORD.memmove JNI Method Windows GHSA-6r3w-6jpj-x5w6 + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions...

Rocky Linux 8 [CIQ] Security Update: lldpad / lldpad-debuginfo / lldpad-debugsource (crlsa-2019_3673)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20193673 advisory. lldptool: improper sanitization of shell-escape codes CVE-2018-10932 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_10978)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410978 advisory. python: Virtual environment venv activation scripts don't quote paths CVE-2024-9287 python: Unbounded memory buffering in SelectorSocketTransport.writelin...

MongoDB Compass 1.44.0 < 1.49.12 Code Injection

The version of MongoDB Compass installed on the remote host is 1.44.0 prior to 1.49.12. It is, therefore, affected by a vulnerability: - MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that...

Rocky Linux 10.2 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc (crlsa-2026_39304)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639304 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from t...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2025_1915)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251915 advisory. emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme CVE-2025-1244 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 8 [CIQ] Security Update: gegl04 / gegl04-debuginfo / gegl04-debugsource / gegl04-devel (crlsa-2022_0177)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220177 advisory. gegl: shell expansion via a crafted pathname CVE-2021-45463 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...