999 matches found
wappalyzergo
Wappalyzergo A high performance port of the Wappalyzer Technology Detection Library to Go. Inspired by Webanalyze. Uses data from https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Features Very simple and easy to use, with clean codebase. Normalized regexes +...
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...
CVE-2026-116676
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-116676
The Atlantis self-hosted Go application (versions 0.4.0 through 0.47.1) is vulnerable to OS command injection . The flaw exists because the application passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments, which are joined using strings.Join(args,...
CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-116676
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE
Unauthenticated POST to /pbx/gate?bean=web.XmlTransBean with a crafted XmlTransBean payload reaches com.brekeke.util.Util.execString and runs arbitrary commands via sh -c. !/usr/bin/env python3 -- coding: utf-8 -- """Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE""" from future import...
PT-2026-127754
Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...
PT-2026-126705
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
GitPython CVE-2022-24439 ext URL RCE
CVE-2022-24439 GitPython = 3.1.29: malicious ext::sh clone URL runs shell commands when an HTTP app passes user input to clonefrom with protocol.ext.allow=always. !/usr/bin/env python3 -- coding: utf-8 -- """GitPython CVE-2022-24439 ext:: transport RCE via clone URL injection.""" from future impo...
@frontmcp/adapters (>=1.0.4, <=1.10.6), @frontmcp/edge (>=1.9.2, <=1.10.6) +2 more potentially affected by CVE-2026-115751 via mcp-from-openapi (>=2.3.0, <=2.8.0)
mcp-from-openapi NPM version =2.3.0, =1.0.4, =1.9.2, =0.0.1, =0.1.0, =0.16.0 Source cves: CVE-2026-115751 Source advisory: MEND:CVE-2026-115751...
@frontmcp/adapters (>=1.5.0, <=1.10.6), @frontmcp/edge (>=1.9.2, <=1.10.6) +2 more potentially affected by CVE-2026-115750 via mcp-from-openapi (>=2.5.0, <=2.8.0)
mcp-from-openapi NPM version =2.5.0, =1.5.0, =1.9.2, =1.5.0, =0.1.0, =0.16.0 Source cves: CVE-2026-115750 Source advisory: MEND:CVE-2026-115750...
CVE-2026-103038
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...
EUVD-2026-104454
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...
PT-2026-117477
Name of the Vulnerable Software and Affected Versions PingTools Network Utilities version 4.64 Description The application contains an OS command injection flaw within the Watcher ICMP service. A local attacker capable of creating or modifying a Watcher service can provide an arbitrary value in t...
CVE-2026-103038: Improper Neutralization of Special Elements used in an OS Command
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...
CVE-2026-111988
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-111988
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...