CVE-2026-93965 aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93965 aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93965

A command injection vulnerability exists in aiyiyi121 SxDevOps versions 1.0 and 1.1 , specifically in the MCP STDIO Server Management component. The flaw resides in the subprocess.Popen call within backend/aiops/services.py, where unsanitized input through the endpoint_or_command argument allows ...

EUVD-2026-83658

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93965 aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

wingdata

Wingdata — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン VHost 列挙で WingFTP サーバーを発見。CVE-2025-47812 のコマンドインジェクションで初期アクセスを取得。root 権限は、細工された tar アーカイブを展開する sudo Python リストアスクリプトを経由して取得 — tar のパストラバーサルにより root として任意のファイルを書き込む。 列挙 root@kitploit: nmap -sC -sV wingdata.htb -Pn 22/tcp open ss...

CVE-2026-93958

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-93958 D-Link R95 DHMAPI ssi system os command injection

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-93958 D-Link R95 DHMAPI ssi system os command injection

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-93958

CVE-2026-93958 is an OS command injection vulnerability in the D-Link R95 router (firmware BE9500_1.00.16). The flaw resides in the DHMAPI component, specifically the system function within the file /bin/ssi. By manipulating the NTPServer argument, an attacker can inject arbitrary operating-syste...

EUVD-2026-83637

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

SUSE CVE-2026-35582

Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The INFILEENDING and...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

CVE-2026-94031: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

CVE-2026-93967: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generatehosttask of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attac...

CVE-2026-93966: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.execcommand of the file backend/ops/hosttasks.py of the component TASKRUNCOMMAND. Such manipulation of the argument command leads to command injection. The attack may be...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93958: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

PT-2026-96015

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description An issue exists in the LAN IP Configuration Handler component within the /usr/bin/network tools file. A remote attacker can perform command injection by manipulating the ipv4 argument...

PT-2026-95912

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description A command injection flaw exists in the MCP STDIO Server Management component within the subprocess.Popen function of the backend/aiops/services.py file. A remote attacker can exploit this...