Topic
User-controlled input reaching Git subcommands without an end-of-options delimiter, turning values such as branch names into flags like --exec.
Gotenberg's 8.30.1 patch validated metadata keys but not values, so CVE-2026-40281 lets unauthenticated callers move files as root. The dev.to write-up of the bug does not name a fixed release, so operators have no confirmed version to move to.
Reality
n8n disclosed two server-takeover flaws on October 5, rated CVSS 8.7 and 9.4, with fixes in versions 1.123.76, 2.37.7 and 2.38.2. On a shared instance, the 8.7-rated sandbox escape lets anyone who can edit a workflow run code on the server.
Reality
AWS's Bedrock AgentCore Python SDK shipped fixes in v1.6.1 and v1.18.1 for one argument-injection flaw in install_packages(). Teams that let agents or users name packages for Code Interpreter sandboxes should check those names before the SDK sees them.
Reality
Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.
Reality
JFrog found that an unprivileged account on a Mac running Parallels Desktop 26.4.0 can reach the root dispatcher over a world-writable socket and run code as uid 0 through argument injection in the appliance installer.
Perspective Coverage
3 publishersReality
CERT Polska's breakdown of the September RouterOS compromises names two bugs, CVE-2026-67279 and CVE-2026-86060, and the forum logs that match the chain start on September 2, a day before MikroTik shipped fixes.
Reality