FreeBSD -- Kernel use-after-free bug in the TIOCNOTTY handler

Problem Description: The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory. Impact: A...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010950 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in ttydriverlookuptty When specifying an invalid console= device li...

CVE-2026-0930

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

CVE-2026-0930 Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

CVE-2026-0930 Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

CVE-2026-0930

CVE-2026-0930 affects wolfSSHd on Windows and describes a potential read-out-of-bounds in the handling of a terminal resize. An authenticated user could trigger the out-of-bounds read after establishing a connection, leaking adjacent stack memory to the pseudo-console output. Public sources (NVD;...

CVE-2026-0930 Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

CVE-2026-0930

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

wolfSSH 安全漏洞

WolfSSH is a small, fast, and portable SSH implementation of wolfSSL, including support for SCP and SFTP. WolfSSH has security vulnerabilities, particularly an out-of-bounds read vulnerability when handling terminal resizing requests, which may lead to authenticated users leaking adjacent stack...

PT-2026-33853

Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...

Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories

The authors of this paper release Terminal Wrench, a subset of 331 terminal-agent benchmark environments, copied from the popular open benchmarks that are demonstrably reward-hackable. The data set includes 3,632 hack trajectories and 2,352 legitimate baseline trajectories across three frontier...

Exploit for CVE-2026-39987

CVE-2026-39987 marimo is a reactive Python notebook. Prior to...

SUSE SLED15: iproute2 / iproute2-arpd / iproute2-bash-completion / etc (SUSE-SU-2026:1418-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1418-1 advisory. This update for iproute2 fixes the following issue: - CVE-2024-58251: denial of service via terminal escape sequences...

ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick

It was found that WEBrick did not sanitize all its log messages. If logs were printed in a terminal, an attacker could interact with the terminal via the use of escape sequences...

CVE-2026-32648 Anviz Products Missing Authorization

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details e.g., SSH/RTTY status, assisting attackers in reconnaissance against the device...

CVE-2026-32648

Affected products: Anviz CX2 Lite and CX7. The CVE-2026-32648 vulnerability allows unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), aiding reconnaissance against the device. The available sources (NVD/NVD-based entries and ENISA EUVD) confirm the issue bu...

OS Command Injection

taskflow-ai is vulnerable to OS Command Injection. The vulnerability is due to a security flaw in the terminalexecute component, where performing a manipulation results in os command injection and the attack is possible to be carried out remotely...

Anviz CX7和Anviz CX2 Lite 安全漏洞

Both Anviz CX7 and Anviz CX2 Lite are products of the American company Anviz. The Anviz CX7 is a smart terminal device integrated with biometric identification and access control functions. The Anviz CX2 Lite is also a smart terminal device that integrates face recognition and access control...

Linux Distros Unpatched Vulnerability : CVE-2026-40228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a logger -p emerg command is executed, if...