CVE-2026-46850: Undefined Security Weakness

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell for VS Code. The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Shell. While the vulnerability is in...

CVE-2026-46869: Undefined Security Weakness

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell: Dump and Load. Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Shell...

CVE-2026-46870: Undefined Security Weakness

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell for VS Code. The supported version that is affected is 2026.2.0+9.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the...

Linux Distros Unpatched Vulnerability : CVE-2025-56814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A code injection vulnerability in the wxExecute function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters...

PT-2026-50447

Name of the Vulnerable Software and Affected Versions OpenHuman desktop agent versions prior to 0.56.0 Description The shell tool command allowlist in the SecurityPolicy can be bypassed to execute arbitrary OS commands with the privileges of the desktop user. This occurs due to two flaws in...

CVE-2026-55743: Improper Neutralization of Special Elements used in an OS Command

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 default Supervised security policy can be bypassed to execute arbitrary OS commands with the privileges of the desktop user...

CVE-2026-55748: Improper Neutralization of Special Elements used in an OS Command

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

PT-2026-52474

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0663 Description A Vimscript code injection issue exists in the s:NetrwLocalRmFile function within the netrw plugin runtime/pack/dist/opt/netrw/autoload/netrw.vim when deleting a local file from the browser. The probl...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Post-Handshake SSH Channel process. An attacker can bypass access control by injecting extra data after the SSH handshake, allowing unauthorized access to restricted resources. Remediation Upgrade...

GHSA-G796-JQMX-WF9Q Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c226-q6fx-6j6c. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses...

Duplicate Advisory: Shell inline-command parsing could miss an allowlist check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f397-5vjw-v2c2. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows...

GHSA-V383-2WGG-V483 Duplicate Advisory: Shell inline-command parsing could miss an allowlist check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f397-5vjw-v2c2. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows...

Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5cj2-3jr2-5h77. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken stri...

GHSA-27PQ-2PH8-8X25 Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5cj2-3jr2-5h77. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken stri...

CVE-2026-39598 WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2...

CVE-2026-39598 WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2...

CVE-2026-39598

CVE-2026-39598 concerns WordPress Academy LMS Pro plugin (pre-3.5.2). The vulnerability is an Unrestricted Upload of File with a Dangerous Type, enabling an attacker to upload a web shell to the web server. Affected: Academy LMS Pro prior to 3.5.2. CVSS 3.1 metrics indicate NETWORK attack Vector,...

Malicious code in @kalipto/local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f The package is a purpose-built remote-control agent. On startup when the bin is invoked with --token, e.g. npx @kalipto/local --token..., index.js...

MAL-2026-5922 Malicious code in @kalipto/local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f The package is a purpose-built remote-control agent. On startup when the bin is invoked with --token, e.g. npx @kalipto/local --token..., index.js...

CVE-2026-46871

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell for VS Code. The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. Successful attacks...