game-music-emu 0.6.5 VGM Command Interpreter Out-Of-Bounds Read / DoS

An out-of-bounds read in the VGM command interpreter of game-music-emu libgme, the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to crash the hosting process or to have adjacent heap memory influence the rendered audio, via a PCM seek...

game-music-emu 0.6.5 VGM Command Interpreter Missing Operand Out-Of-Bounds Read

An out-of-bounds read in the VGM command interpreter of game-music-emu libgme, the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to read heap memory past the end of the buffer holding the file. The read happens as soon as playback...

CVE-2026-13248

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

Deno: Command Injection via spawnSync & spawn on Windows

Summary Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters such as &, |, , ^, !, , , and did not neutralize %...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30303

The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30302

The CodeRider-Kilo command auto-approval module is vulnerable to OS Command Injection , which can lead to Remote Code Execution (RCE) . The root cause is the use of an incompatible Unix-based shell-quote library to analyze commands on the Windows platform, combined with a failure to correctly han...

CVE-2026-32948

A flaw was found in sbt, a build tool for Scala and Java. On Windows, sbt uses the cmd /c command interpreter to execute version control system VCS commands. A remote attacker can exploit this by providing a specially crafted URI fragment such as a branch, tag, or revision name in the build...

CVE-2026-31995 OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...

Control Validation: The Missing Link in Security Assurance

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! You've got the prettiest security...

CVE-2023-36634

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

Moxa EDR Command Interpreter Code Execution

The vulnerability of the command interpreter in Moxa EDR-810, EDR-G902, EDR-G903, TN-4900, and TN-5916 microprogrammed service routers stems from errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HTTP/HTT...

PT-2022-5680 · Moxa · Moxa Edr-G903 +4

Name of the Vulnerable Software and Affected Versions: Moxa EDR-810 versions affected versions not specified Moxa EDR-G902 versions affected versions not specified Moxa EDR-G903 versions affected versions not specified Moxa TN-4900 versions affected versions not specified Moxa TN-5916 versions...

Moxa TN-5916 web service RCE

The vulnerability of the command interpreter in Moxa’s TN-5916 microprogrammed router service software is related to errors during the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Moxa EDR-810 Router Command Interpreter Code Execution

The vulnerability of the command interpreter in Moxa EDR-810, EDR-G902, EDR-G903, and TN-4900 router software-based web services is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-33870

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted...

CVE-2022-33870

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted...

CVE-2022-29058

An improper neutralization of special elements CWE-89 used in an OS command vulnerability CWE-78 in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4....

Format string

A format string vulnerability CWE-134 in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 throu...