CVE-2026-28197: Improper Neutralization of Argument Delimiters in a Command

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted...

CVE-2026-28198: Improper Verification of Cryptographic Signature

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted roo...

Cisco Integrated Management Controller UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, the Cisco Integrated Management Controller is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with vali...

MAL-2026-16274 Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-16275 Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection due to the hook editor handling in cmd/uniget/hooks.go. An attacker can execute arbitrary commands by setting EDITOR or UNIGETEDITOR to a value containing shell metacharacters and then invoking the hook...

CVE-2026-54575

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

EUVD-2026-48244

Grav: FlexDirectory::dynamicDataField executes arbitrary callables from blueprint data with no validation...

CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-54575

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

EUVD-2026-82327

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CLSA-2026-1789662743 Fix of 6 CVEs

SECURITY UPDATE: shell metacharacter injection via daemon config hooks and RSYNCCONNECTPROG - debian/patches/CVE-2026-53790.patch: backport the upstream fix - CVE-2026-53790 SECURITY UPDATE: daemon inner-chroot module path escape in the /./ handling - debian/patches/CVE-2026-53793.patch: backport...

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Summary A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling...

GHSA-Q69G-4HCV-6JG4 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Summary A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling...

CVE-2026-71538 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

CVE-2026-71538

@cyclonedx/cyclonedx-npm prior to 6.0.0 is vulnerable to a Windows-specific shell injection in the fallback execution path of src/npmRunner.ts, used when npm_execpath does not resolve the npm CLI. An untrusted value passed to the --workspace option is incorporated into a shell command without san...

CVE-2026-71538 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

CVE-2026-71538: Improper Neutralization of Special Elements used in an OS Command

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...