CVE-2026-54795

Dell OpenManage Enterprise versions prior to 4.7.0 have an OS Command Injection flaw; a low-privileged remote attacker can inject special characters into input to execute arbitrary commands. Dell's DSA-2026-359 advisory recommends updating to 4.7.0 or later. No exploitation details are provided i...

CVE-2026-54795

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

EUVD-2026-62435

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-54795

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

EUVD-2026-62402

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-54796

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS Command Injection flaw (CWE-78) exploitable by a high-privileged remote attacker, leading to full command execution and HIGH confidentiality, integrity, and availability impact. Dell DSA-2026-359 provides the fix; upgrade to 4.7.0 o...

CVE-2026-54796

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-54796

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Stata Command Injection via Unsanitized package in adopackageinstall SummaryThe adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python...

Malicious code in mcp-dev-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...

RLSA-2026:56130 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Linksys E1500/E2500

Module exploits remote command execution in Linksys E1500/E2500 devices. Diagnostics interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E1500/E2500""" import time from kittysploit import...

Huawei Router HG532 RCE

Module exploits remote command execution in Huawei Router HG532 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Router HG532 RCE""" from kittysploit import from...

Linksys WAP54Gv3

Module exploits remote command execution in Linksys WAP54Gv3 devices. Debug interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WAP54Gv3""" import re from kittysploit import from...

Cisco IOS HTTP Unauthorized Administrative Access

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS HTTP Unauthorized Administrative Access"""...

Netcore/Netis UDP/53413 Backdoor RCE

Exploits the Netcore/Netis UDP backdoor on port 53413 for unauthenticated remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP/53413 backdoor RCE — opens execute session.""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Watchguard XCS Remote Command Execution

Exploits unauthenticated SQL injection and authenticated command injection in Watchguard XCS virtual appliances to gain command execution as nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Watchguard XCS Remote Command Execution""" import hashlib import re from random import randint from...

Netgear RAX30 RCE

Module exploits remote command execution in Netgear RAX30 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear RAX30 RCE""" from kittysploit import from...

Malicious code in @lilsccott6x9/devpipe-connector (npm)

Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and executes them via childprocess.execSync. The setup.js script...