Most recent entries from all

BELL-CVE-2026-7246

Affected: Alpaquita:stream: py3-click

BREW-acronym-CVE-2026-7246

Affected: Homebrew: acronym

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

certfr-2026-avi-0834 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0834

Withdrawn: CLEANSTART-2026-DU27033 — Security fixes in apache-superset 5.0.0-r8

Withdrawn by the publisher.

Affected: CleanStart: apache-superset

Package apache-superset version 5.0.0-r8 fixes 6 vulnerabilities: ghsa-537c-gmf6-5ccf, CVE-2026-34180, ghsa-6v7p-g79w-8964, CVE-2026-57585, CVE-2026-44405...

EUVD-2026-355255

fkie_cve-2026-7246

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

msrc_CVE-2026-7246 — Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

msrc_CVE-2026-7246

OESA-2026-2302 — python-click security update

Affected: openEuler:24.03-LTS-SP1: python-click

Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It&apos;s the &quot;Command Line Interface Creation Kit&quot;. It&apos;s highly configurable but comes with sensible defaults out of the box. Security Fix(es):

Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)

openSUSE-SU-2026:10760-1 — python311-click-8.3.3-2.1 on GA media

python311-click-8.3.3-2.1 on GA media

PYSEC-2026-2132

Affected: PyPI: click

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

RHSA-2026:24761 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit() minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance Vite: Vite: Information disclosure via WebSocket connection bypasses access control cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

SUSE-SU-2026:22254-1 — Security update for python-click

Security update for python-click

Withdrawn: UBUNTU-CVE-2026-7246

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: python-click, Ubuntu:18.04:LTS: python-click, Ubuntu:20.04:LTS: python-click, Ubuntu:22.04:LTS: python-click, Ubuntu:24.04:LTS: python-click, Ubuntu:25.10: python-click, Ubuntu:26.04: python-click

(Pallets Click, versions 8.3.2 and below, contain a command injection v ...)

WID-SEC-W-2026-3046 — IBM Concert: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.