CVE-2026-117530

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

CVE-2026-117530

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

EUVD-2026-110698

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

CVE-2026-117530

The JetBrains Junie CLI is vulnerable to command execution in versions prior to 26.8.17 . The root cause is incomplete validation of allowlisted commands (CWE-184). This flaw allows for unauthorized command execution, potentially impacting confidentiality, integrity, and availability. Remediation...

PT-2026-126356

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

NPM: Payload: Incomplete validation during the upload file lifecycle

NPM: Payload: Incomplete validation during the upload file lifecycle vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

CVE-2026-101882

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the...

CVE-2026-101882

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the...

CVE-2026-101882: Incomplete List of Disallowed Inputs

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the...

CVE-2026-5059-poc

¿Dónde está CVE-2026-5059 en el código? La vulnerabilidad está en dos archivos que trabajan juntos: Archivo 1: tools.py — La causa raíz La versión antigua usaba shell=True en executepipedcommand: root@kitploit: CÓDIGO ANTIGUO VULNERABLE process = subprocess.run command, ← cadena sin procesar pasa...

CVE-2026-55072

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

EUVD-2026-77635

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the matrix-sdk-ui crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious...

[SECURITY] [DSA 6490-1] fort-validator security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 08, 2026 https://www.debian.org/security/faq -...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

EUVD-2026-71748

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-84377

A flaw was found in LiteLLM, a proxy server for Large Language Model LLM APIs. An authenticated remote attacker could exploit incomplete request validation to redirect outbound provider calls to an attacker-controlled destination. This Server-Side Request Forgery SSRF vulnerability could lead to...

CVE-2026-84061

A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 throu...

CVE-2026-80722 wifi: mac80211: validate individual TWT params before driver setup

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

Linux Distros Unpatched Vulnerability : CVE-2026-80722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before...