31921 matches found
CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...
CVE-2026-14881
CVE-2026-14881 affects MongoDB Compass: during imports of connections, an attacker can override connection options that are not normally changeable via the connection form. Specifically, a custom browser open command for the OIDC authentication flow can be injected, which is typically configured ...
GHSA-4V35-78JC-648R Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...
CVE-2026-65590
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH...
CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH...
CVE-2026-57599
The CVE concerns privilege escalation in some Hikvision cameras caused by incorrect permission allocation in the device program. Attacking would require authentication via SSH and could grant the attacker full control of the affected device. The entry provides CVSS‑3.1 metrics (Network, High atta...
CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH...
PT-2026-63348
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
EUVD-2026-46397
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...
EUVD-2026-46388
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...
EUVD-2026-46391
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...
CVE-2026-64881
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...
EUVD-2026-41606
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...
CVE-2026-64878
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...
CVE-2026-64879
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...
CVE-2026-64881 Command Injection
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...
CVE-2026-64878
CVE-2026-64878 is a command-injection vulnerability described as unvalidated input in asset filter parameters that allows shell metacharacters to escape command argument handling, enabling remote code execution on a low-privileged OS user via the Analysis REST endpoint. The connected Tenable advi...