28160 matches found
CVE-2026-35020
This CVE ID has been rejected by the its CVE Numbering Authority CNA. It was determined that the attack requires an attacker to already control arbitrary environment variables, a level of access they consider functionally equivalent to code execution and outside the threat model of CLI tools...
CVE-2026-5677 Totolink A7100RU cstecgi.cgi CsteSystem os command injection
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been...
Exploit for Classic Buffer Overflow in Apple Ipados
⚠️ CVE-2026-28858 — Buffer Overflow en Apple iOS/iPadOS ╔...
CVE-2026-35175
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15...
GO-2026-4920 KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai...
CVE-2026-34982 Vim modeline bypass via various options affects Vim < 9.2.0276
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader options are missing the PMLE flag, allowing a modeline to be executed...
CVE-2026-5663 OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible...
Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps
Your attack surface no longer lives on one operating system, and neither do the campaigns targeting it. In enterprise environments, attackers move across Windows endpoints, executive MacBooks, Linux infrastructure, and mobile devices, taking advantage of the fact that many SOC workflows are still...
MAL-2026-2500 Malicious code in totally-safe-util (npm)
Multiple suspicious behaviors: postinstall script, hex obfuscation, OS command execution to open a Rickroll, and attempt to hide execution. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d45a8a1395a8ff66e2ea74cacd9d8de0ebaa9e88e0170a6907b3e4861a2acc5 The packa...
CVE-2026-5619 Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection
A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarizecommand. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access...
libxpc macOS Unauthorized Access
The vulnerability of the libxpc library in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
PT-2026-30562
A flaw has been found in Braffolk mcp-summarization-functions up to 0.1.5. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarize command. Executing a manipulation of the argument command can lead to os command injection. The attack requires local access...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1)
The version of AOS installed on the remote host is prior to 7.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1 advisory. - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library...
Vim operating system command injection vulnerability
Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0276 contained a vulnerability related to operating system command injection. This vulnerability stemmed from a model line sandbox bypass, allowing arbitrary operating system commands to be...
PackageKit Privilege Escalation
The vulnerability of PackageKit for macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
iTunes Store Component Bypass
The vulnerability of the iTunes Store component for iPadOS and iOS is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...
configd daemon in operating
The vulnerability of the configd daemon in macOS operating systems is related to integer overflow. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected information...
Shortcuts Component Unauthorized Access
The vulnerability of the Shortcuts component in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
AppleScript macOS Data Compromise
The vulnerability of AppleScript components in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...