Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

CVE-2023-38646

Metabase Pre-Auth RCE POC - CVE-2023-38646 Metabase ओपन सोर्स 0.46.6.1 से पहले और Metabase Enterprise 1.46.6.1 से पहले हमलावरों को सर्वर पर मनमाने कमांड निष्पादित करने की अनुमति देते हैं। मैंने हमलावर की मशीन पर रिवर्स शेल प्राप्त करने के लिए स्क्रिप्ट सीधे लिखी है। उपयोग स्क्रिप्ट को Target URL,...

Exploit for CVE-2025-21065

CVE-2025-21065 A PoC for CVE-...

Exploit for OS Command Injection in Fortinet Fortisandbox

CVE-2026-39808 — Fortinet FortiSandbox OS Command Injection...

GHSA-JQMF-MX4F-HFR6 Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Summary: 5 findings — BashTool shell-injection sink F6, the canonical RCE primitive, BackgroundRunTool async shell-injection sink F7, backtest execmodule runs top-level statements before the SignalEngine class check F8 — independent RCE path that does not match BashTool signatures, readurl outbou...

CVE-2026-82041

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041

UTMStack versions before 11.2.16 are vulnerable to a missing authorization flaw in the UTMIncidentCommandWebsocket.processCommand() function. Specifically, the handler mapped to the /command/{hostname} STOMP destination fails to perform role checks or apply a command allowlist. This allows any au...

EUVD-2026-91796

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970

GitLab has remediated a critical vulnerability in the GitLab AI Gateway component (CWE-1336) affecting versions 18.1.6 before 19.2.4 , 19.3 before 19.3.2 , and 19.4 before 19.4.1 . An authenticated user with Duo Agent Platform access could exploit a template engine weakness to escape the prompt t...