54 matches found
CVE-2026-90927
filebrowser through 2.63.23 contains a denial-of-service vulnerability in the /api/command handler . The server fails to limit WebSocket message size before performing permission checks, allowing any authenticated user to buffer arbitrarily large messages and exhaust server heap memory. Notably, ...
EUVD-2026-77445
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...
CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...
CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...
CVE-2026-90620
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
CVE-2026-90620
0x4m4 HexStrike AI is affected by a missing authentication vulnerability in the API Command Endpoint (file hexstrike_server.py), allowing remote attackers to exploit it with no prior privileges. The affected range extends up to commit d689933ff579d839c676c82b231f8e98326c5f04; no specific version ...
CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
EUVD-2026-77187
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
PT-2026-91034
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
RHCOS 2 : rubygem-openshift-origin-console (RHSA-2015:1808)
The remote Red Hat Enterprise Linux CoreOS 2 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1808 advisory. - 2.2: API command injection vulnerability CVE-2015-5274 Note that Nessus has not tested for this issue but has instead relied only on the...
Vulnerabilities fixed in Fortinet FortiWeb
Fortinet has fixed vulnerabilities in FortiWeb Versions 7.0 to 8.0.1. The vulnerabilities include an ability for remote unauthenticated attackers to bypass hostname restrictions, an OS command injection vulnerability within the FortiWeb API, and the ability to bypass authentication rate-limits...
CVE-2026-0785
ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific flaw...
EUVD-2025-205598
Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent POST api/command/run. Version 1.15.1 fixes the issue...
EUVD-2015-4055
Malware in sbrugna...
EUVD-2018-13772
Malware in sbrugna...
EUVD-2019-3017
Malware in sbrugna...
EUVD-2017-9560
Malware in sbrugna...