CVE-2026-16826

CVE-2026-16826 affects the Debug Server component of IBM i versions 7.3, 7.4, 7.5, and 7.6. The root cause is CWE-78 (OS Command Injection) : improper neutralization of special elements used in an OS command, allowing a local attacker with low privileges to execute arbitrary commands . NVD scores...

CVE-2026-17499

CVE-2026-17499 is an OS command injection (CWE-78) in the Debug Server component of IBM i versions 7.6, 7.5, 7.4, and 7.3. A local attacker with low privileges can execute arbitrary commands due to improper neutralization of special elements used in an OS command. IBM rates the impact as MEDIUM (...

CVE-2026-75166

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...

CVE-2026-85623

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623

goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...

EUVD-2026-71230

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions

goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...

EUVD-2026-71029

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

Exploit for CVE-2024-36057

CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-3...

EUVD-2026-70916

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X , a rack accessory product, contains an OS Command Injection vulnerability (CWE-78) that allows unauthenticated attackers to inject arbitrary OS commands. The flaw carries a CVSS 9.8 CRITICAL score (v3.0) with high impact on confidentiality, integrity, and availability, indicati...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

EUVD-2026-70850

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

EUVD-2026-70814

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...