CVE-2026-8217 Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection

A security flaw has been discovered in Industrial Application Software IAS Canias ERP 8.03. Impacted is the function Runtime.getRuntime.exec of the component RMI Interface. Performing a manipulation of the argument troiaCode results in os command injection. The attack may be initiated remotely. T...

PT-2026-39435

Name of the Vulnerable Software and Affected Versions Industrial Application Software IAS Canias ERP version 8.03 Description A flaw in the RMI Interface component allows for remote OS command injection. This occurs through the manipulation of the troiaCode argument within the...

CVE-2026-44115

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime...

MAL-2026-3287 Malicious code in ams-ssk (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 31 published versions 1.0.0 through 1.0.33 are malicious. Pairs with common-tg-service, which performs the client-side Telegram account takeover. ams-ssk is the...

CVE-2026-40320

Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted...

CVE-2026-32065 OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution

OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to...

Claude Code Security and Magecart: Getting the Threat Model Right

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI...

CVE-2025-11165

A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine VTools that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

EUVD-2019-11475

Malware in sbrugna...

Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmed

Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fastlog to steal Solana and Ethereum wallet keys from source code. The crates, named fasterlog and asyncprintln, were published by the threat actor under the alias rustguruman and...

SUSE CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

spring-cloud-function: Remote code execution by malicious Spring Expression

A flaw was found in Spring Cloud Function via the spring.cloud.function.routing-expression header that is modified by the attacker to contain malicious expression language code. The attacker is able to call functions that should not normally be accessible, including runtime exec calls...

BOINC - Certificates or keys found, External URLs, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application BOINC published at the 'play' market has multiple vulnerabilities...

Debugger for Android Apps - Exported components, Possible privilege escalation, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application Debugger for Android Apps published at the 'play' market has multiple vulnerabilities...

로보카 폴리 전화 : 영상통화로 배우는 생활습관 - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application 로보카 폴리 전화 : 영상통화로 배우는 생활습관 published at the 'play' market has multiple vulnerabilities...

The Voice Of Italy - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application The Voice Of Italy published at the 'play' market has multiple vulnerabilities...

Simple Clean Weather Iconset - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Simple Clean Weather Iconset published at the 'play' market has multiple vulnerabilities...

Iconset of Flat Card Style - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Iconset of Flat Card Style published at the 'play' market has multiple vulnerabilities...