Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon-core is a Decepticon contract layer: pure types, protocols, plugin contracts, registry primitives Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon-sdk is a Decepticon plugin author SDK: protocols, fixtures, scaffolding Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via UntrustedOutputMiddleware.formatenvelope and...

CVE-2026-61732

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

EUVD-2026-86329

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732

Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-79766

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

Exploit for Improper Input Validation in Unrealircd

CVE-2010-2075 — UnrealIRCd 3.2.8.1 Backdoor Exploit !Python...

Exploit for Code Injection in Apache Ofbiz

ofbiz-xmlrpc-rce CVE-2023-49070 PoC for the Apache OFBiz XM...

CVE-2026-81552

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-81547

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81545

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-85912

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-81552 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-81552

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a flaw that could allow a remote authenticated attacker to execute arbitrary commands . The root cause is identified as the improper neutralization of environment variables . This vulnerability carries a High base severity (CVSS...

CVE-2026-61817

A flaw was found in pgpartman. A user with partmanuser privileges can exploit a SQL injection vulnerability by storing malicious SQL in the partconfig.timedecoder value. This malicious SQL is then executed without proper validation during certain maintenance operations. This can lead to privilege...