CVE-2026-57998 better-npm-audit OS Command Injection via registry flag

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

MAL-2026-14358 Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-53541

OliveTin , a web interface for executing predefined shell commands, is vulnerable to improper input validation in its executor. The filterToDefinedArgumentsOnly function in service/internal/executor/executor.go contains a special case that allows any user-supplied argument prefixed with ot_ to by...

CVE-2026-62676

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-41449

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-62676

Omnigent , an open-source AI agent framework for orchestrating coding agents, contains a policy bypass in its shared shell-command parser (omnigent/policies/builtins/_shell.py) prior to version 0.3.0. The parser fails to recognize combined interpreter flags, timeout/nice/setsid/stdbuf wrappers, c...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-41449

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 are affected by a command injection vulnerability in the _run_command function. The root cause is the failure to sanitize untrusted data—such as usernames, process names, or filenames—before passing it to shell execution, allowing attack...

EUVD-2026-64009

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

Exploit for Improper Access Control in Widgetfactorylimited Jce

JCEzploit-CVE-2026-48907 JCEzploit is a powerful, fully-aut...

Exploit for OS Command Injection in Devcode Openstamanager

CVE-2025-69212 - OpenSTAManager P7M Command Injection Exploit...

Exploit for CVE-2026-41567

CVE-2026-41567 1day One day for Docker Escape CVE-2026-41567...

CVE-2026-47827

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabilities...

Malicious code in scrambleeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df The package advertises a numeric shuffle utility but its sole public function scrambleeer opens a TCP socket to bax.h4x.tv on port 6363, dup2's the...