EUVD-2026-90209

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

MAL-2026-17339 Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

CVE-2026-102874

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

EUVD-2026-89574

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

CVE-2026-102874 HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

CVE-2026-102874

A vulnerability exists in HKUDS AnyTool 0.1.0 within the Execute Endpoint component. Specifically, the subprocess.run function in the file anytool/local_server/main.py is susceptible to OS command injection due to the improper manipulation of the command/shell argument. This flaw allows for remot...

CVE-2026-102874 HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

CVE-2026-102874: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

PT-2026-102999

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-79537

metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...

CVE-2026-100568 OpenClaw before 2026.8.1 Unauthorized Command Job Access

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

PT-2026-99204

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Insufficient access restrictions to operator command cron jobs allow model-visible agent callers to read and execute ownerless command jobs. This allows attackers to inspect stored environment...

Malicious code in chromatitle-js (npm)

Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with javascript-obfuscator 400-entry rotating string-array decoder,...

Malicious code in chromatitle (npm)

Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level, transferring control to src/utils/bootstrap.js...

Malicious code in chromatitle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...

MAL-2026-17174 Malicious code in chromatitle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...

CVE-2026-85029: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to improper limitation of a pathname to a restricted directory...

PT-2026-98978

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

CVE-2026-93643: Improper Limitation of a Pathname to a Restricted Directory

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...