CVE-2026-16932

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 fail to properly validate the ODMDIR environment variable, allowing a local attacker with low privileges to execute arbitrary commands. CVSS 3.1 scores this HIGH (8.8), with impact on confidentiality, integrity, and availability. Exploitation status is not pro...

[SECURITY] [DSA 6453-1] libgit2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/security/ Aron Xu August 20, 2026 https://www.debian.org/security/faq -...

CVE-2026-18482

Neo.mjs is affected by a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server. The issue stems from the checkSyntax() and runPlaywrightTest() functions unsafely interpolating caller-controlled absolutePath values into shell command...

CVE-2026-18482 CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

EUVD-2026-63266

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

Malicious code in @httttt/mcp-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ee4beb2634f91de84901fbeb18674445c67c33a45c93a6509f72e03fe1a01b6 The package registers an MCP tool named execcommand that accepts a command string argument from the connected MCP client and passes it directly to...

EUVD-2026-62969

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

EUVD-2026-62937

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

EUVD-2026-62900

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the editmanagerxml capability could write a malicious Splunk Web Manager Extensible Markup Language XML configuration. When the same user opens the affected Splunk Web Manag...

EUVD-2026-63105

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

PT-2026-79035

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

Linux Distros Unpatched Vulnerability : CVE-2026-76220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg wi...

PT-2026-79171

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper privilege management may allow a local attacker to execute arbitrary commands. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-18835: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17142: Improper Authentication

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication...

CVE-2026-16997: Improper Privilege Management

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management...

CVE-2026-54449: Improper Neutralization of Special Elements used in a Command

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-18482: Improper Neutralization of Special Elements used in an OS Command

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

CVE-2026-77077: Improper Control of Generation of Code

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...