CVE-2026-8985

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-47708

CVE-2026-47708 (MCP-for-Stata) : Multiple sources describe a command-injection vulnerability in the log_file_name parameter used by the stata_do/stata-mcp wrapper. Prior to version 1.17.3, log_file_name is interpolated into a Stata command string without sanitization; the GuardValidator does not ...

CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...

CVE-2026-47708 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...

CVE-2026-47690

MeltanoHub (hub.meltano.com) had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173, where a pull_request_target workflow could exfiltrate the repository GITHUB_TOKEN with write permissions. The issue was fixed by the commit 923820de8f64d753951fbbd54f7282a3d5f751...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-44879 Authenticated Command Injection allows arbitrary command execution in CLI Interface

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-44879

CVE-2026-44879 affects HPE Aruba EdgeConnect SD-WAN ECOS gateways with an authenticated, highly privileged attacker able to perform command injection via the CLI. Reported impact is arbitrary command execution on the underlying OS. Affected ECOS versions include 9.4.x.x (≤9.4.6.x), 9.5.x.x (≤9.5....

CVE-2026-64879

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Summary GitPython spawns the real git binary with an argument vector built from caller-supplied values. To prevent argument injection, GitPython maintains denylists of "unsafe" Git options --upload-pack, --receive-pack, --exec, -c, --config, … that can be abused to run arbitrary commands, and...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Repo.archive, Repo.itercommits, Repo.blame, and Git.lsremote call paths in git/repo/base.py, git/objects/commit.py, and git/cmd.py...

CVE-2026-64881 Command Injection

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

CVE-2026-64881

CVE-2026-64881 involves an audit file upload handler that fails to sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. The CVSS scores indicate high impact to co...

CVE-2026-47671

Nhost CLI prior to 1.46.0 exposes an unauthenticated, cross-origin-configurable configserver via nhost dev. The hidden configserver serves Mimir GraphQL with dummy authorization and permissive CORS (Access-Control-Allow-Origin: *). An attacker-controlled web page can reach localhost and perform q...

CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

CVE-2026-64879

Technical details about CVE-2026-64879 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-64879 Command Injection

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-64879

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

GHSA-2F96-G7MH-G2HX GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...