Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

CVE-2026-47827 CVE-2026-47827 – BOSH CLI Powershell Injection

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...

CVE-2026-47827

CVE-2026-47827 is a command injection vulnerability in the BOSH CLI tool (Cloud Foundry) on Windows , allowing a remote attacker to execute arbitrary shell commands via PowerShell injection. All versions prior to v2.840.0 are affected. The vulnerability requires an adjacent network position and h...

CVE-2026-47827 - BOSH CLI Powershell Injection | Cloud Foundry

HIGH CVSSv4: High 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions v2.840.0 Description Command...

BIT-POWERSHELL-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability

Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

BIT-RCLONE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

PT-2026-73433

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-50523

Improper neutralization of special elements used in a command 'command injection' in Microsoft PowerShell allows an authorized attacker to execute code locally...

CVE-2026-50523 Microsoft PowerShell Remote Code Execution Vulnerability

...

EUVD-2026-58808

Improper neutralization of special elements used in a command 'command injection' in Microsoft PowerShell allows an authorized attacker to execute code locally...

CVE-2026-50523 Microsoft PowerShell Remote Code Execution Vulnerability

...

CVE-2026-50523

CVE-2026-50523 : Microsoft PowerShell is affected by a vulnerability described as improper neutralization of special elements used in a command (command injection), allowing an authorized attacker to execute code locally. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW attack ...

CVE-2026-50523

Improper neutralization of special elements used in a command 'command injection' in Microsoft PowerShell allows an authorized attacker to execute code locally...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

EUVD-2026-58661

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

CVE-2026-19768 affects Devolutions PowerShell Universal (settings feature) prior to and including 2026.2.3. An authenticated user with settings management permission can cause code injection by writing a crafted setting value that is not properly escaped when written to the settings configuration...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

PT-2026-72120

Name of the Vulnerable Software and Affected Versions Microsoft PowerShell affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an authorized attacker to execute code locally. Recommendations At the moment,...

Microsoft PowerShell 7.4.x < 7.4.19 / 7.5.x < 7.5.10 / 7.6.x < 7.6.5 Multiple Vulnerabilities (macOS)

The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.19, 7.5.x prior to 7.5.10, or 7.6.x prior to 7.6.5. It is, therefore, affected by multiple vulnerabilities: - Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execut...