SyncShield

🔐 SyncShield — Browser Extension for CVE-2018-5764 Detection Detect unsafe Rsync commands before they become exploits A lightweight, privacy-focused browser extension developed as part of Final Year Project NWS/129/23B to detect missing --protect-args flag in Rsync commands — preventing remote...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117573 hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117573 hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

EUVD-2026-110849

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117573

The hagent tool (through commit 761eec6) is vulnerable to an OS command injection vulnerability within the hagent_arduino and hagent_esp32 tools. The flaw exists because the args parameter is improperly sanitized, allowing attackers or prompt-injected agents to supply metacharacters that are inte...

PT-2026-126430

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent arduino and hagent esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-92171

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...

CVE-2026-92171 Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...

CVE-2026-92171

A flaw in the Infinispan Operator for Red Hat Data Grid allows for sensitive information disclosure when cross-site (xsite) TLS is enabled. The operator launches the Gossip Router container using keystore and truststore passwords as plain-text command-line arguments (-tls_keystore_password, -tls_...

PT-2026-118021

Coraza: ProcessURI silently drops QUERY STRING and ARGS GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpcputargs Failure of copytouser results in an early return without properly cleaning up the fdlist; this has been updated by the DSP. This may lead to a map leak. The fix involves...

Astra Linux – vulnerability in mariadb-10.3

It has been discovered that MariaDB versions 10.2 through 10.7 contain a segmentation fault caused by the Itemargs::walkargs component...

Astra Linux – vulnerability in mariadb-10.3

It has been discovered that MariaDB Server versions v10.6.5 and earlier contain a use-after-free vulnerability in the Itemargs::walkarg component, which can be exploited via specially crafted SQL statements...

CVE-2026-97471

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

EUVD-2026-100799

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

CVE-2026-97471

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 3.16.1 . The flaw exists in the args[link_target] parameter, which allows unauthenticated attackers to extract arbitrary user meta values for any user ID. This includes ...

CVE-2026-97471 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

CVE-2026-97471 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

PT-2026-113629

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslink target' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...