CVE-2026-30624

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the...

CVE-2026-30625

Upsonic version 0.71.6 is vulnerable to remote code execution (RCE) due to a flaw in the MCP server/task creation functionality . The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist is in place, certain permitted commands like npm and npx...

CVE-2026-30624

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the...

CVE-2026-30624

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the...

CVE-2026-30617

LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When...

PT-2026-33072

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the...

PT-2026-33073

Name of the Vulnerable Software and Affected Versions Upsonic version 0.71.6 Description An issue exists in the MCP server/task creation functionality where users can define MCP tasks with arbitrary command and args values. While an allowlist is implemented, specific permitted commands such as np...

CVE-2026-30625

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands npm, npx accept argument flags that enable...

CVE-2026-30625

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands npm, npx accept argument flags that enable...

CVE-2026-30624

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the...

CVE-2026-33414

Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $...

CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run loads a YAML file with type: job, the...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Vim vulnerabilities (USN-8171-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8171-1 advisory. Nathan Mills discovered that Vim could crash when parsing certain regular expressions...

USN-8171-1: Vim vulnerabilities

Nathan Mills discovered that Vim could crash when parsing certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10 CVE-2026-32249 It was discovered that Vim did not properly sanitize user input...

Command Injection

Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection through improper option parsing in the clone method. An attacker can execute arbitrary system commands by...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) relates to the implementation or modification of arguments, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the exploitation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the allowlist mode of the AI agent OpenClaw (formerly ClawdBot or MoltBot) allows a violator to execute arbitrary commands.

The vulnerability of the allowlist mode for the AI agent OpenClaw previously – ClawdBot or MoltBot is related to the use of an incomplete black list. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) is related to the use of an incomplete black list, allowing the intruder to execute arbitrary commands.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the use of an incomplete black list. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) arises from the failure to take measures to neutralize special elements, allowing the intruder to execute arbitrary commands.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Remote Code Execution (RCE)

stata-mcp is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient validation of user-supplied Stata do-file content, which allows an attacker to inject and execute arbitrary commands...