36183 matches found
MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...
MAL-2026-12000 Malicious code in streak-math-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...
MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...
Malicious code in sextant-cli-darwin-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...
PT-2026-68011
Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description The Git deployer component contains an OS Command Injection flaw. The pullRepo function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec to run a shell command that interpolate...
PT-2026-68894
Name of the Vulnerable Software and Affected Versions dracut affected versions not specified Description A flaw exists in the die error-handling function which writes messages into a shell script within the initramfs emergency-hook directory without proper shell-quoting. An attacker on the adjace...
PT-2026-68331
Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...
CVE-2026-71243: Improper Neutralization of Special Elements used in an OS Command
The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...
Exploit for CVE-2026-60004
CVE-2026-60004 - Gitea Once executed, the script will automa...
GHSA-5GPJ-VJ23-VHHV Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...
CVE-2025-29296
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...
CVE-2026-69255
Flowise (drag-and-drop LLM flow builder) versions prior to 3.1.3 are vulnerable to arbitrary code execution via the CSVAgent component. Attacker-controlled CSV data is interpolated directly into executable Python before being passed to Pyodide , bypassing the validatePythonCodeForDataFrame() deny...
CVE-2026-61515
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...