CVE-2026-84967

The MongoDB extension for Visual Studio Code fails to neutralize special characters in a connection string before embedding it into a command line composed for the Launch MongoDB Shell integrated terminal. An unauthenticated remote attacker who convinces a developer to accept a user-supplied conn...

EUVD-2026-70525

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

SUSE-SU-2026:23612-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

SUSE-SU-2026:23464-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

OPENSUSE-SU-2026:21747-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

SUSE-SU-2026:3959-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives bsc1274857. - CVE-2026-66486:...

Security update for cpio

This update for cpio fixes the following issues: CVE-2026-66484: path traversal allows creating hard links outside intended directory via malicious tar archives bsc1274856. CVE-2026-66485: denial of service via uncontrolled memory allocation from crafted archives bsc1274857. CVE-2026-66486:...

OPCFoundation OPC UA LocalDiscoveryServer (LDS)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...

CVE-2026-39987 — Updated!

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

OPENSUSE-SU-2026:21741-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

bitbang-cli v0.5.0

BitBang CLI bitbang is a single static binary remote-access multitool. From any browser: an interactive shell and file browser access to the remote machine. You can also reach web apps on that machine's network. Beyond the browser, it does TCP port forwarding, file copy, and terminal sharing. It...

...[ More ]

This Metasploit module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelps legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An...

BIT-GITLAB-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

openSUSE 16 Security Update : rav1e (openSUSE-SU-2026:21681-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21681-1 advisory. This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and...

openSUSE 16: gstreamer-devtools / gstreamer-devtools-devel / etc (openSUSE-SU-2026:21689-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21689-1 advisory. - CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruptio...

SUSE-SU-2026:23441-1 Security update for cpio

This update for cpio fixes the following issues: Security issues fixed: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory...

USN-8704-1: GNU cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...