CVE-2026-19334

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product ...

CVE-2026-19334 NightTrek Ollama-mcp index.ts command injection

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product ...

EUVD-2026-54869

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...

CVE-2026-19284

MauricioMilano coder-api up to version 1.1.0 is affected by a local, command-injection vulnerability in the Projects Endpoint. The issue resides in the function createProject (src/core/projects.ts) and is triggered by input manipulation within that path. The attack is described as requiring local...

CVE-2026-19284

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...

CVE-2026-19282

The CVE describes a local command-injection risk in the andreahaku llm_memory_mcp project, affecting the auto.capture function in src/autolearn/GitHooksManager.ts. The root cause is a manipulation of the argument hash, enabling injection, with exploitation restricted to local access. No product v...

CVE-2026-19279

Technical details about CVE-2026-19279 are not publicly available in the provided documents beyond the summary. Monitor for updates from the vendor and CVE record.

CVE-2026-19044

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

EUVD-2026-53934

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-19039

The vulnerability CVE-2026-19039 affects Kino-Kafkaesque ssh-mcp-server (SSH Command Handler) specifically the function ssh_exec in src/index.ts. The issue arises from manipulation of the host/username argument, enabling command injection. Exploitation is described as a local attack, with the thr...

CVE-2026-16631

A flaw was found in publint. A local attacker can exploit an operating system OS command injection vulnerability by manipulating input processed by the childprocess.exec function. This allows the attacker to execute arbitrary commands on the system where publint is running, potentially leading to...

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

CVE-2026-16631

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16629

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

CVE-2026-16629

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

CVE-2026-16628 oclif JIT Plugin Entry child_process.exec os command injection

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

PT-2026-63510

Name of the Vulnerable Software and Affected Versions oclif versions prior to 4.23.17 Description An OS command injection issue exists in the JIT Plugin Entry Handler component. A local attacker can manipulate the jitPlugins argument to execute arbitrary commands via the child process.exec...

PT-2026-63512

Name of the Vulnerable Software and Affected Versions syncfusion ej2-javascript-ui-controls versions prior to 33.2.4 Description An OS command injection flaw exists when the software is accessed locally. The issue resides in the child process.exec function within the package.json file, where...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...