CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

tmux v3.7c

Welcome to tmux! tmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattached. This release runs on OpenBSD, FreeBSD, NetBSD, Linux,...

ANT-2026-3SEPW083 · ncurses · Stack-buffer-overflow

stack-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by an unreleased Anthropic model REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-3SEPW083: Stack buffer overflow in SGR mouse...

resterm v1.1.1

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

CVE-2026-74870

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

PYSEC-2026-3956

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

CVE-2026-74870

openssl_encrypt (pip) versions

CVE-2026-74870 openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

CVE-2026-54336: Improper Limitation of a Pathname to a Restricted Directory

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-75108: Missing Authorization

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

PT-2026-76810

Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...

CVE-2026-75483: Improper Neutralization of Escape, Meta, or Control Sequences

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

PT-2026-76606

Name of the Vulnerable Software and Affected Versions openssl encrypt pip versions prior to 1.4.8 Description An information exposure issue exists where the diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' unconditionally print the full derived hardware pepper as hex to stdout/stderr v...

PT-2026-76802

Name of the Vulnerable Software and Affected Versions Next Terminal affected versions not specified Description Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints. This allows any authenticated user to probe and wake assets they are not...

[SECURITY] Fedora 44 Update: rust-git-interactive-rebase-tool-2.4.1-17.fc44

Full-featured terminal-based sequence editor for Git interactive rebase...

SUSE CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73506

A flaw was found in Oh My Posh, a customizable terminal prompt renderer. The software failed to properly sanitize attacker-controlled data, such as current directory names and Git metadata, before displaying it in the terminal. This oversight allows for terminal escape sequence injection, enablin...

CVE-2026-73480

A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface TUI. An attacker can craft malicious directory or file names...

EUVD-2026-58481

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

Linux Distros Unpatched Vulnerability : CVE-2026-73480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file...