CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

SUSE CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

EUVD-2026-63690

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63741

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-63748

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-63624

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63619

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

mboxshell v0.7.1

mboxShell Fast terminal viewer for MBOX files of any size. Open, search and export emails from Gmail Takeout backups 50 GB+ without loading them into memory. Leer en Espanol / Spanish Why this project exists When you export your email from Gmail using Google Takeout, you get one or more .mbox fil...

PT-2026-79343

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...

PT-2026-79285

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

PT-2026-80226

Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...

PT-2026-79459

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http servers/linux mcp server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

...[ More ]

Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...

PT-2026-79273

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

PT-2026-79413

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description The shared shell-command parser in omnigent/policies/builtins/ shell.py fails to recognize combined interpreter flags, command substitutions, a single background control operator, and wrappers such ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102021)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102021 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has ...

Linux Distros Unpatched Vulnerability : CVE-2026-55558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220...

Kibana 9.1.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-97 / ESA-2026-89)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-89 and ESA-2026-97 advisories. - The Elastic Security capability that suggests existing field values while a user authors endpoint polic...

PT-2026-79410

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eva...