CVE-2026-97366 jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

EUVD-2026-86461

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97366

A security flaw exists in jhen0409 react-native-debugger versions up to 0.14.0 . The vulnerability is located in the openDevTools function within the electron/window.js file of the Open in Editor Handler component. By manipulating the host argument, an attacker can trigger an os command injection...

CVE-2026-97366

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.

Red Hat build of Apache Camel 4.18.4 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

GHSA-3CJ3-HQCR-G934 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

EUVD-2026-42475

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint...

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

CVE-2026-84399 Botslab G980H Dashcams Incorrect Authorization

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

EUVD-2026-86412

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

CVE-2026-84399 Botslab G980H Dashcams Incorrect Authorization

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

CVE-2026-84399

The Botslab G980H dash camera firmware contains an authorization vulnerability within its session-based command functionality. The root cause is the product's failure to sufficiently associate an authenticated session with the specific client connection that established it. Because subsequent pri...

CVE-2026-93289 OS command injection in Eufy Omni C20, Omni X10 Pro

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

EUVD-2026-86410

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-93289

The Eufy Omni C20 and Omni X10 Pro are vulnerable to an OS command injection attack. This vulnerability allows an unauthenticated attacker to execute arbitrary system commands during the pairing process . While the specific root cause is not detailed in the provided documents, the impact is signi...

CVE-2026-93289 OS command injection in Eufy Omni C20, Omni X10 Pro

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon-sdk is a Decepticon plugin author SDK: protocols, fixtures, scaffolding Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via UntrustedOutputMiddleware.formatenvelope and...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon is an AI-powered autonomous red team testing framework Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via UntrustedOutputMiddleware.formatenvelope and...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview decepticon-core is a Decepticon contract layer: pure types, protocols, plugin contracts, registry primitives Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via...