CVE-2025-8943

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2025-48861

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps...

CVE-2025-48862

Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted...

Claude Code: Operating System Command Injection Vulnerability

Claude Code is an open source proxy coding tool from Anthropic. An operating system command injection vulnerability exists in versions of Claude Code prior to 1.0.4, which stems from an overly broad list of allowed security commands that could lead to unacknowledged file reads and network transfe...

CVE-2025-7961 KAP 3.6.0 - TCC Bypass

Improper Control of Generation of Code 'Code Injection' vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0...

CVE-2025-7961 KAP 3.6.0 - TCC Bypass

Improper Control of Generation of Code 'Code Injection' vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0...

CVE-2025-7961

CVE-2025-7961 affects Wulkano KAP for MacOS (version 3.6.0). The root cause is Improper Generation of Code (Code Injection), enabling a TCC bypass. The CVSS-like data indicates Local attack, Low privileges, No user interaction, with Confidentiality impact High and other impacts limited (Integrity...

CVE-2025-48500

A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support Eo...

Exploit for OS Command Injection in Fortinet Fortisiem

watchTowr-vs-FortiSIEM-CVE-2025-25256 Detection Artifact Gene...

CVE-2025-9026

CVE-2025-9026 affects D-Link DIR-860L (firmware 2.04.B04). The vulnerability is in the Simple Service Discovery Protocol component, specifically the ssdpcgi_main function in htdocs/cgibin, enabling remote OS command injection. Publicly disclosed exploit indicates active risk, with impact on confi...

Linux Distros Unpatched Vulnerability : CVE-2024-39835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A code injection vulnerability has been identified in the Robot Operating System ROS 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys...

Huawei EnzoH-W5611T OS Command Injection Vulnerability

Founded in 1987 and headquartered in Shenzhen, Guangdong Province, China, Huawei is a leading global provider of ICT information and communications technology infrastructure and smart terminals, with operations in more than 170 countries and regions and serving more than 3 billion people worldwid...

PT-2025-33497

Name of the Vulnerable Software and Affected Versions: Wulkano KAP version 3.6.0 Description: Improper Control of Generation of Code 'Code Injection' in Wulkano KAP on MacOS allows TCC Bypass. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...

Linux Distros Unpatched Vulnerability : CVE-2025-21907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm: memory-failure: update ttu flag inside unmappoisonedfolio Patch series mm: memoryfailure: unmap poisoned folio during migrate properly, v3. Fix two bugs...

Linux Distros Unpatched Vulnerability : CVE-2022-49742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: f2fs: initialize locks earlier in f2fsfillsuper syzbot is reporting lockdep warning at...

Linux Distros Unpatched Vulnerability : CVE-2015-10141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. Wh...

Linux Distros Unpatched Vulnerability : CVE-2025-22108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxten: Mask the bdcnt field in the TX BD properly The bdcnt field in the TX BD specifies the total number of BDs for the TX packet. The bdcnt field has 5 bits...

CVE-2025-27759

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code o...

MAL-2025-15172 Malicious code in avalon-cli-run-ios (npm)

The package avalon-cli-run-ios was found to contain malicious code...

CVE-2025-20253

A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is due to the improper processing of...