CVE-2026-49980

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /remote:path/object. The remote value is parsed from the URL and passed...

EUVD-2026-39018

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /remote:path/object. The remote value is parsed from the URL and passed...

CVE-2026-48732 Warp: Remote SSH cwd can lead to unauthorized remote command execution

Warp is an agentic development environment. From 0.2023.03.21.08.02.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for...

Astra Linux – Vulnerability in qBittTorrent

All versions of the qBittorrent client up to 4.5.5 use default credentials when the web user interface is enabled. Administrators are not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

MAL-2026-6302 Malicious code in hashd-edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f8480ae1ab46f8b6f61848c271af2819d88644df8d8f36b04b458103c5d5454 The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js forks itself as a detached...

CVE-2026-56274 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a regex bypass in local file access restrictions. An attacker with a Flowise account of any role, or API access with view/update permissions f...

samba: Remote Code Execution in SAMR

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...

samba: Remote Code Execution in SAMR

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...

The vulnerability of the btool Configuration Helper tool, a software tool for working with machine learning algorithms like Splunk AI Tookit (formerly known as Splunk Machine Learning Toolkit (MLTK)), allows a perpetrator to execute arbitrary commands.

The vulnerability of the btool Configuration Helper tool of the Splunk AI Tookit formerly Splunk Machine Learning Toolkit MLTK relates to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker t...

ROS-20260623-73-0016

Vulnerability in Python 3.13 related to the failure to take measures for data cleaning at the management level. Exploitation of this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260623-73-0011

The vulnerability in Python3 is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260623-73-0014

Vulnerability in Python 3.11 related to the lack of measures taken to clean data at the management level. Exploitation of this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260623-73-0012

Vulnerability in Python 3.9 related to the lack of measures taken to clean data at the control level. Exploitation of this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260623-73-0013

Vulnerability in Python 3.10 related to the failure to take measures for data cleaning at the management level. Exploitation of this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260623-73-0047

The vulnerability of the pgAdmin 4 database management tool is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

MAL-2026-6272 Malicious code in @variational/common-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75a12ea18e08fc325a5698f1da2246ffdfdaa4650971fa2b335fd0904e517079 The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require. Sensitive strings hostname...

The vulnerability in the webfile_mgrc.ipl software for D-Link DNS-320 allows a hacker to execute arbitrary commands.

The vulnerability in the webfilemgrc.cgi script of the D-Link DNS-320 network storage software exists due to the lack of measures taken to neutralize special elements used in the operating system’s command syntax. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

Amazon Linux 2023 : mariadb114, mariadb114-backup, mariadb114-client-utils (ALAS2023-2026-1845)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1845 advisory. During the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute...

PYSEC-2026-246

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims...

CVE-2025-71357

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims...