Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: khyrenz Component: Parseusbs Clear all filters
TI-2026-28873 CVE-2026-40030 · GHSA-pqxv-pjgq-x85w

parseusbs < 1.9 Command Injection via Volume Path Argument

Priority MEDIUM 40

parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls, allowing arbitrary command injection vi…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00763 Published 2026-04-08 Fixed in 1.9.0 CWE-78
TI-2026-28872 CVE-2026-40029 · GHSA-2m8h-6748-cf32

parseusbs < 1.9 Command Injection via Crafted LNK Filename

Priority MEDIUM 40

parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitrary command execution via crafted .lnk file…

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00819 Published 2026-04-08 Fixed in 1.9.0 CWE-78