consult-llm-mcp 操作系统命令注入漏洞

consult-llm-mcp is a multi-model code consultation server developed by Raine Virta. Versions of consult-llm-mcp prior to 2.5.3 had an operating system command injection vulnerability. This vulnerability stemmed from incorrect operations with parameters gitdiff.baseref/gitdiff.files in the...

Apple Security Advisory 03-24-2026-2

Apple Security Advisory 03-24-2026-2 - iOS 18.7.7 and iPadOS 18.7.7 addresses bypass, null pointer, out of bounds access, and use-after-free vulnerabilities...

PT-2026-29100

Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, i...

The vulnerability of the panthor_sched_unplug() function in the drivers/gpu/drm/panthor/panthor_sched.c file of the Panthor driver (which provides DRM support for ARM Mali CSF-based graphics processors) in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the panthorschedunplug function in the drivers/gpu/drm/panthor/panthorsched.c file of the Panthor driver which provides DRM support for ARM Mali CSF-based graphics processors in the Linux operating system is related to the use of memory after deallocation. Exploiting this...

ROOT-OS-ALPINE-318-CVE-2023-49285 CVE-2023-49285 in rootio-squid - Patched by Root

Root has patched CVE-2023-49285 in the rootio-squid package for Root:Alpine:3.18. Multiple fixed versions available...

Codebase MCP 操作系统命令注入漏洞

Codebase MCP is a code library retrieval and analysis tool developed by DeDeveloper23. Codebase MCP has a vulnerability related to operating system command injection. This vulnerability stems from a function in the Component RepoMix Command Handler called getCodebase/getRemoteCodebase/saveCodebas...

CVE-2026-5012 elecV2 elecV2P rpc pm2run os command injection

A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem ear...

CVE-2016-20044

Removed by vendor...

TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign

Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices. The activity has been attributed with high confidence to the Russian state-sponsored threat group known as...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0801

Updates of 'mozjs', 'nss' packages of Photon OS have been released...

Photon OS 5.0: Mozjs PHSA-2026-5.0-0801

An update of the mozjs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0801. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

NewStart CGSL MAIN 7.02 : webkitgtk Vulnerability (NS-SA-2026-0037)

The remote NewStart CGSL host, running version MAIN 7.02, has webkitgtk packages installed that are affected by a vulnerability: - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2,...

mcp-docs-rag MCP Server 操作系统命令注入漏洞

The mcp-docs-rag MCP Server is a RAG Q&A server developed by Kazuhiro Homma, based on local documentation. Versions of the mcp-docs-rag MCP Server prior to 0.5.0 contained an operating system command injection vulnerability. This vulnerability stems from the cloneRepository function in the...

websec-payloads

Web Security Payloads & Exploitation Reference Comprehensiv...

Vulnerabilities fixed in F5 Networks BIG-IP, F5OS and NGINX App Protect WAF

F5 Networks has fixed vulnerabilities in the BIG-IP and F5OS product lines and NGINX App Protect WAF. The vulnerabilities include several configuration issues and exploit vectors. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of...

EUVD-2026-16600

The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

EUVD-2026-16591

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network...

CVE-2026-4622

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network...

CVE-2026-4620

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network...

Multiple vulnerabilities in BUFFALO Wi-Fi routers

Overview Wi-Fi router products provided by BUFFALO INC. contain multiple vulnerabilities listed below. Dependency on vulnerable third-party component CWE-1395 - This issue is caused by a vulnerability in minihttpd CVE-2015-1548. OS command injection CWE-78 - CVE-2026-27650 Code injection CWE-94 -...