189324 matches found
Arbitrary Command Injection
Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the detect-vulnerable-config-writes path in the argv-parser package, where unsanitised arguments passed to git...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded befor...
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-76737
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...
CVE-2026-76727
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...
CVE-2026-76724
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...
CVE-2026-100292
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...
Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029
Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...
EUVD-2026-89367
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...
CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...
CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...
CVE-2026-100292
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...
CVE-2026-76737 Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...
CVE-2026-76737 Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...
CVE-2026-76737
A path traversal vulnerability exists in the command line interface of HPE Networking Instant On . This authenticated vulnerability allows an attacker with administrative access to modify a limited set of files on the underlying operating system and interrupt the normal operation of the affected ...
EUVD-2026-89356
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...
EUVD-2026-89347
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...
CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...
EUVD-2026-89346
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...
CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...