EUVD-2023-60601

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...

Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

Pull the certificate off the flash of a Shark RV2320EDUS robot vacuum, and you can run root commands on other people's Shark vacuums across the same AWS region: watch the camera, drive the robot, read the map of the house, and take the Wi-Fi password in plaintext. A researcher publishing under th...

The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing a malicious actor to execute arbitrary commands remotely.

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

CVE-2026-58655

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...

CVE-2026-58655 Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...

CVE-2026-58655 Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...

CVE-2026-13385

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middleMITM user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware '...

PT-2026-60130

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

CVE-2026-58655: Improper Control of Generation of Code

The bundled Grav Flex Objects plugin getgrav/grav-plugin-flex-objects before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values page.header.flex.collection.title or...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

EUVD-2026-44410

Post-authentication improper control of generation of code 'Code Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands...

PT-2026-63410

Name of the Vulnerable Software and Affected Versions Check Point Security Management affected versions not specified Multi-Domain Security Management affected versions not specified Description An authentication bypass allows an unauthenticated remote attacker to execute administrative commands ...

ROS-20260714-73-0067

The vulnerability in ZooKeeper is related to the incorrect processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution

This module exploits a Server-Side Request Forgery SSRF vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to execute...

Malicious code in n8n-nodes-rce-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c735b8bb20a784446d7a0a4c49369ca3f2696bfe2e8a004799c763fc0a064aca On require by n8n module-load, top-level code in dist/RceNode.node.js, the package runs a shell command via execSync'/bin/sh',.... The command is tak...

MAL-2026-10503 Malicious code in n8n-nodes-rce-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c735b8bb20a784446d7a0a4c49369ca3f2696bfe2e8a004799c763fc0a064aca On require by n8n module-load, top-level code in dist/RceNode.node.js, the package runs a shell command via execSync'/bin/sh',.... The command is tak...

Malicious code in node-procmetrics (npm)

node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metrics" decoy name, published by the disposable account [email protected] package first published 2026-07-13. Every published version 1.0.0 through 1.0.6 ships a malicious...

MAL-2026-10218 Malicious code in pure-folder-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e83bf74d7c84c48a1a478d7bb40bbd899c4fda613f1512b66184d3de478b480 [email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry src/build.js decodes an obfuscate...