CVE-2026-57133 PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

EUVD-2026-78392

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57136

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-57136 PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

EUVD-2026-78421

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

CVE-2026-19515

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CLSA-2026-1789466646 vim: Fix of 3 CVEs

CVE-2026-73072: reset slsalfirst in setsofo so a spell file with an SNSAL section before an SNSOFO section cannot under-count the mapping lists and write past the allocation - CVE-2026-73076: forbid a .VimballRecord member filename and only execute well-formed delete commands when removing a...

CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CVE-2026-19515

CVE-2026-19515 is an OS command injection vulnerability in the WSO2 Integrator MI VS Code extension . The extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources , allowing a crafted project to inject and execute...

EUVD-2026-78364

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CLSA-2026-1789464785 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CLSA-2026-1789464719 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CLSA-2026-1789464361 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

EUVD-2026-78332

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

CVE-2026-77853

CVE-2026-77853 is an OS Command Injection vulnerability in LiteOn FlexFi products FF-RFI079I4 and FF-RFI078I4 . An authenticated user with access to the M-Plane (NETCONF) interface can execute arbitrary operating system commands, leading to high impact on confidentiality , integrity , and availab...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...