CVE-2026-55887: Improper Neutralization of Argument Delimiters in a Command

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-44968: Improper Neutralization of Argument Delimiters in a Command

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-49373: Improper Neutralization of Argument Delimiters in a Command

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings...

CVE-2022-24953: Improper Neutralization of Argument Delimiters in a Command

The CryptGPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions...

CVE-2020-7851: Improper Neutralization of Argument Delimiters in a Command

Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the internal method. A remote attacker could induce a user to access a crafted web page, causing...