9701 matches found
[SECURITY] [DSA 6453-1] libgit2 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/security/ Aron Xu August 20, 2026 https://www.debian.org/security/faq -...
CVE-2026-18482
The software Neo.mjs is vulnerable to a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server. The root cause is the unsafe interpolation of caller-controlled absolutePath values into shell commands by the checkSyntax() and runPlayw...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
EUVD-2026-63266
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
Malicious code in @httttt/mcp-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ee4beb2634f91de84901fbeb18674445c67c33a45c93a6509f72e03fe1a01b6 The package registers an MCP tool named execcommand that accepts a command string argument from the connected MCP client and passes it directly to...
EUVD-2026-62969
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.
The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
PT-2026-79171
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper privilege management may allow a local attacker to execute arbitrary commands. Recommendations At the moment, there is no information about a newer version that...
PT-2026-78899
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...
PT-2026-79035
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...
PT-2026-79136
Name of the Vulnerable Software and Affected Versions OTRS Community Edition affected versions not specified Description An authenticated OS command injection exists in the PGP encryption module. This issue occurs because configuration values provided by administrators are concatenated into a she...
CVE-2026-76404
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
CVE-2026-76349
In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...
CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...
EUVD-2026-62858
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
GHSA-JJ7C-H3WM-VJFW vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-16875
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection...
CVE-2026-16848
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...
CVE-2026-16882
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain an OS command injection flaw (improper neutralization of special elements) exploitable remotely with no authentication; CVSS 9.8 critical. IBM reference: https://www.ibm.com/support/pages/node/7283858. Exploitation details not provided in documents.