CVE-2026-90808

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

CVE-2026-90808

HKUDS nanobot versions up to 0.2.1 contain an incomplete blacklist vulnerability in the ExecTool component, specifically in the _guard_command/_spawn functions within nanobot/agent/tools/shell.py. An attacker with low privileges can exploit this remotely (no user interaction required) to achieve ...

EUVD-2026-77768

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...

PT-2026-91403

A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool. guard command/ExecTool. spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch...

The vulnerability of the intel_pmu_enable_event() function in the arch/x86/events/intel/core.c module, which is part of the Linux operating system’s x86 kernel support, allows a hacker to trigger a service failure.

The vulnerability of the intelpmuenableevent function in the arch/x86/events/intel/core.c module, which is part of the Linux operating system’s x86 kernel support, relates to the use of an incomplete blacklist during the processing of input data. Exploiting this vulnerability could allow a...

Exploit for Incomplete List of Disallowed Inputs in Fastgpt

fastgpt-sandbox-audit FastGPT Python sandbox escape chain aud...

CVE-2026-71232

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog...

CVE-2026-71232

CVE-2026-71232 concerns MacCMS10: specifically, the admin template editor (application/admin/controller/Template.php) had a blacklist-based filter that failed to block several PHP functions (exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, e...

CVE-2026-16129

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129

The CVE-2026-16129 entry concerns princezuda SafestClaw (Built-in Web Interface) with a flaw in ShellAction._validate_command in src/safestclaw/actions/shell.py of the Built-in Web Interface. The vulnerability is described as an incomplete blacklist in the command validation logic, enabling local...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

EUVD-2026-45390

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-52888

NocoBase before 2.1.0-alpha.46 exposes sensitive data via the SQL Collection feature. The plugin-collection-sql checkSQL() used an incomplete keyword blacklist that did not block PostgreSQL system catalogs (e.g., pg_shadow, pg_roles, pg_stat_activity), allowing an admin-role user to read password...

CVE-2026-52888 NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete...