PT-2026-96168

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.12.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0 Description The v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticate...

CVE-2024-11680

ProjectSend CVE-2024-11680 エクスプロイト これは、ProjectSend における CVE-2024-11680 の概念実証エクスプロイトです。この脆弱性は認証不要の設定変更とウェブシェルのアップロードを可能にします。 説明 このエクスプロイトは ProjectSend の複数の脆弱性を利用します: CSRFトークンのバイパスによる設定変更 安全でないクライアント登録設定 無制限のファイルアップロードによるリモートコード実行 必要条件 Python 3.x 必要な Python パッケージ: root@kitploit: pip install request...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the shell-out handlers process. An attacker can execute arbitrary operating system commands by supplying specially crafted filenames containing shell metacharacters. Remediation Upgrade james-heinrich/getid3 to...

pterodactyl

Pterodactyl — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン サブドメイン上に Pterodactyl Panel が公開されていた。CVE-2025-49132 のパストラバーサルにより、認証なしで Laravel アプリケーションキーとデータベース認証情報が漏洩する。抽出したハッシュをクラックすることで SSH アクセスを取得する。権限昇格は CVE-2025-6018（PAM 環境変数ポイズニングにより偽のグラフィカル polkit セッションを作り出す）と CVE-2025-6019（XFS...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

DEBIAN-CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

UBUNTU-CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106 getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106 getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106

getID3 before 1.9.26 is affected by an OS command injection vulnerability in its shell-out handlers, which fail to escape filenames when constructing command strings. An attacker can craft a malicious filename containing shell metacharacters to inject arbitrary commands that execute with the priv...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106 getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

EUVD-2026-83726

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106: Improper Neutralization of Special Elements used in an OS Command

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

PT-2026-95957

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.26 Description An OS command injection flaw exists in shell-out handlers that fail to properly escape filenames before incorporating them into command strings. Attackers can use filenames containing shell...

Joern 4.0.631

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-93993 Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user...

CVE-2026-93993

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in its worktree creation process . The root cause is that git hooks are executed before trust validation , allowing an attacker to supply a repository with a crafted post-checkout hook that runs arbitrary shell commands wit...

CLSA-2026-1789783256 rsync: Fix of 7 CVEs

CVE-2026-70456: reserve the slot readargs needs for its trailing NULL, so a peer argument count landing exactly on maxargs cannot write one pointer past the argv allocation - CVE-2026-70458: refuse FLAGHLINKED when hard links are not in use and on a directory entry, so a peer cannot displace the...