ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

EUVD-2026-118496

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the...

CVE-2026-102610

The fast-agent framework (prior to version 0.7.21 ) is vulnerable to unauthenticated access because the fast-agent serve command binds to 0.0.0.0 on port 8000 without authentication. Any network client reaching the /mcp endpoint can invoke exposed agent tools. If started with the --shell flag, an...

EUVD-2026-117900

The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host...

CVE-2026-108387

A flaw was found in radare2. An attacker can exploit this vulnerability by convincing a user to open or analyze a specially crafted binary file. When parsed, malicious data causes radare2 to invoke an internal debugging handler that executes system commands with attacker-supplied arguments. This...

CVE-2026-54141

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an...

CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without establishing an...

CVE-2026-85627

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as th...

CVE-2026-82912

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...

CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

EUVD-2026-117476

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82910 Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82910

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to Server-Side Template Injection (SSTI) within the MacroScreenRenderer component. The root cause is that the renderLink function concatenates link parameter values verbatim into an unquoted, unescaped template-source string. A remote aut...

PT-2026-137566

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.57.13 Description An issue exists where remote direct messages received through a configured Yuanbao channel are converted into a generic channel AgentTurnRequest that utilizes the default tool policy without...

SEPPmail AG Secure Email Gateway code injection vulnerability

The SEPPmail AG Secure Email Gateway contains a code injection vulnerability. This vulnerability arises because attacker-controlled replacement text is executed as Perl code within the sender/receiver substitution rules. As a result, an unauthenticated remote sender may execute operating system...

CVE-2020-17530

OGNL Injection Exploit Summary Simple Python script to exploit OGNL injection vulnerabilities in Apache Struts2/Tomcat and execute system commands. Usage pip install requests colorama python3 exploit.py -u http://target/index.action -c "id"...

CVE-2020-12641

CVE-2020-12641: Command Injection via “imconvertpath” Parameter in Roundcube Webmail A Command Injection vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "imconvertpath" does not perform sanitization/input filtering, an attacker with access to the Roundcube...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-115904

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...