CVE-2026-90620

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620

0x4m4 HexStrike AI is affected by a missing authentication vulnerability in the API Command Endpoint (file hexstrike_server.py), allowing remote attackers to exploit it with no prior privileges. The affected range extends up to commit d689933ff579d839c676c82b231f8e98326c5f04; no specific version ...

CVE-2026-90620 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

EUVD-2026-77187

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

PT-2026-91034

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-90620: Missing Authentication for Critical Function

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...

CVE-2026-67344: Missing Authorization

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

GHSA-48QW-824M-86PR ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Impact A user holding only reader read-only privileges on a single database could execute arbitrary JVM code by sending a "language": "js" command to the POST /api/v1/command/database HTTP endpoint, and use it to read arbitrary files on the host filesystem e.g. /etc/passwd, configuration files,...

PT-2026-38264

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.21 Description The UI server WebSocket accepts connections from all origins by default, exposing several endpoints. A malicious website visited by a developer using a browser can establish a cross-origin WebSocke...

CVE-2019-25441

thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the runcommand endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on...

CVE-2019-25441

thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the runcommand endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on...

CVE-2019-25447

CVE-2019-25447 concerns OrientDB 3.0.17 GA Community Edition. The connected sources describe cross-site request forgery vulnerabilities that allow an attacker to perform unauthorized actions by crafting requests to endpoints such as /database/, /command/, and /document/. Attackers can create or d...

CVE-2019-25447 OrientDB 3.0.17 Cross-Site Request Forgery

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes,...

CVE-2019-25447 OrientDB 3.0.17 Cross-Site Request Forgery

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes,...

CVE-2019-25441

The CVE-2019-25441 entry concerns thesystem 1.0, where an unauthenticated attacker can trigger a command injection via the run_command endpoint. The vulnerability allows posting shell commands in the command parameter to execute arbitrary system commands on the server. Impact is described as HIGH...

PT-2026-21316

🚨 CVE-2019-25441 thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute...

thesystem 操作系统命令注入漏洞

thesystem is a password management project developed by Kostas Mitroglou. Version 1.0 of thesystem contains a vulnerability related to operating system command injection. This vulnerability stems from the runcommand endpoint, which allows for command injection, potentially enabling unverified...

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise have cross-site scripting vulnerabilities

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise are both products of Flexense Corporation. Flexense Sync Breeze Enterprise Server is a network file synchronization software. Flexense Disk Pulse Enterprise is a real-time file system monitoring software. Both the Flexense...

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise have cross-site scripting vulnerabilities

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise are both products of Flexense Corporation. Flexense Sync Breeze Enterprise Server is a network file synchronization software. Flexense Disk Pulse Enterprise is a real-time file system monitoring software. Both the Flexense...