187822 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-105326
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mail...
RockyLinux 10 : vim (RLSA-2026:75769)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...
PT-2026-106354
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs when the system processes draw objects of an incorrect type during the execution of a graphics command list. Recommendations At the...
Linux Distros Unpatched Vulnerability : CVE-2026-102828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...
Privilege escalation vulnerability exists in the internal Command-Line Interface of Fabric OS (CVE-2026-94577)
: A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypas...
EUVD-2026-89334
simple-git unsafe-operation guard does not block trailer command configuration...
simple-git unsafe-operation guard does not block trailer command configuration
Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...
NPM: simple-git unsafe-operation guard does not block trailer command configuration
NPM: simple-git unsafe-operation guard does not block trailer command configuration vulnerability discovered by ? in WordPress Npm simple-git versions = 3.15.0, 4.0.1...
GHSA-X6JW-M9V5-85VH simple-git unsafe-operation guard does not block trailer command configuration
Affected product The default blockUnsafeOperationsPlugin in simple-git when an application permits untrusted values to reach SimpleGitOptions.config or Git inline configuration arguments such as -c =. Summary trailer..cmd is not recognized as unsafe by the default guard. Therefore, a configured...
NPM: simple-git allows command execution through unblocked Git configuration includes
NPM: simple-git allows command execution through unblocked Git configuration includes vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...
EUVD-2026-89332
simple-git allows command execution through unblocked Git configuration includes...
simple-git allows command execution through unblocked Git configuration includes
Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...
GHSA-G4WM-2VF7-VFGR simple-git allows command execution through unblocked Git configuration includes
Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...
NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291 vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...
GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...
EUVD-2026-89333
simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291...
@nx/docker: OS command injection in the @nx/docker release pipeline
Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...
GHSA-6VC5-VF29-FFR2 @nx/docker: OS command injection in the @nx/docker release pipeline
Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...