CVE-2026-65711

CVE-2026-65711 affects sysPass up to version 3.2.11. An authenticated administrator can trigger an OS command injection via the backup path. The FileBackupService constructs a tar shell command by concatenating the admin-configurable siteBackupPath without proper sanitization (no escapeshellarg o...

CVE-2026-65711 sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

EUVD-2026-44933

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...

GHSA-HQ9Q-27G5-QWPJ Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...

CVE-2026-16733

A flaw was found in bahmutov find-cypress-specs. A local attacker can exploit a vulnerability in the Branch Handler component by manipulating the '--branch' argument. This manipulation leads to an operating system OS command injection, allowing the attacker to execute arbitrary commands on the...

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

...

Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection

A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file listbaseconfig.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible...

EUVD-2026-48434

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763

CVE-2026-16763 affects localstack serverless-localstack up to version 1.4.0. The vulnerability targets an unknown function in src/index.js of the Configuration Handler, where manipulating the argument custom.localstack.docker.compose_file enables local OS command injection. The CVE describes loca...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16735

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-16733 bahmutov find-cypress-specs Branch index.js shell.exec os command injection

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

CVE-2026-16733

The CVE refers to bahmutov find-cypress-specs (up to version 1.54.12) where the function shell.exec in src/index.js of the Branch Handler is vulnerable. Manipulating the --branch argument leads to OS command injection. The attack is described as locally executable, with the exploit publicly avail...

PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands Summary PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a...