41542 matches found
PT-2026-81350
Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description The software contains two security flaws that allow unrestricted operating system command execution. First, the security configuration is disabled by default when the MCP SHELL SEC CONFIG FILE...
PT-2026-81351
Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS command injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist defined in security.yaml. However, the defaul...
PT-2026-81352
Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS Command Injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in security.yaml, whic...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1 . An authenticated adjacent attacker with administrative access can store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
CVE-2026-16348
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
EUVD-2026-65059
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-76072 Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-76072
Continue CLI through 1.5.47 uses an incomplete denylist in evaluateTerminalCommandSecurity.ts as its sole barrier against destructive shell commands in headless and auto modes. The dangerous-path check covers only /, ~, /usr, /etc, /bin, and /sbin, leaving paths like /home, /root, /var, /opt, and...
EUVD-2026-65007
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
CVE-2026-16348
TP-Link Archer BE800 V1 is affected by an authenticated command injection in its VPN connection handling. An attacker with administrative access can inject shell metacharacters via the VPN connection to execute arbitrary system commands with root privileges . Successful exploitation may enable pe...
V8-sandbox-escape-PoC-
V8 Sandbox Escape PoC ⚠️ CRITICAL SECURITY WARNING ⚠️...
Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...
MAL-2026-14430 Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...
Exploit for Command Injection in Apache Ranger
CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS comma...
CVE-2026-76055
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...
CVE-2026-65611
A flaw was found in nnn, a file manager. This vulnerability, known as Shell Command Injection, allows an attacker to execute arbitrary commands. By creating a specially crafted directory name containing shell syntax on a shared filesystem, removable media, or within an extracted archive, an...