enject

enject Oculta los secretos de .env de los ojos de prAIng. Nota: este proyecto se llamaba anteriormente enveil y ha sido renombrado a enject Las herramientas de codificación con IA como Claude Code, Copilot, Cursor y otras pueden leer archivos en tu directorio de proyecto, lo que significa que un...

agentsh

agentsh macOS note: Native macOS enforcement via ESF Endpoint Security Framework + NE Network Extension is in Alpha. It works end-to-end — file, process, and network events flow through the system extension to the Go policy engine — but expect rough edges and breaking changes between releases. Fo...

CVE-2024-12970

CVE-2024-12970 CVE-2024-12970 describe una vulnerabilidad de OS Command Injection Inyección de Comandos del Sistema presente en el software My Computer del sistema operativo Pardus. Esta vulnerabilidad permite a un usuario inyectar comandos del sistema a través del parámetro de nombre de archivo,...

PIL-CVE-2017-8291

Vulnerabilidad de ejecución remota de comandos en Python PIL GhostButt El módulo PIL Pillow para procesar imágenes en Python se ve afectado por la vulnerabilidad GhostButt CVE-2017-8291 porque llama internamente a GhostScript, lo que resulta en una vulnerabilidad de ejecución remota de comandos...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

CVE-2024-29973

CVE-2024-29973 root@kitploit: GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Languag...

StegCracker

StegCracker Utility di brute-force per la steganografia per scoprire dati nascosti all'interno dei file. Cerchi il repository Docker? Lo puoi trovare qui Deprecazione Smetti di perdere tempo e CPU, usa stegseek invece! Non sei convinto? Guarda questi benchmark rubati con amore: password| Line|...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

EUVD-2026-64894

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

Malicious code in mcq-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...

CVE-2026-54449

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-54449 LangBot: Authenticated RCE Via MCP Configuration

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-75149

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-75149 marimo < 0.23.15 Code Injection via MCP Server Configuration

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

EUVD-2026-62665

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-75149 marimo < 0.23.15 Code Injection via MCP Server Configuration

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-76217

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

PT-2026-78557

Name of the Vulnerable Software and Affected Versions marimo versions prior to 0.23.15 Description A code injection flaw exists in the notebook configuration handler. Attackers can execute arbitrary commands by embedding a crafted MCP server entry with a controlled command value within a notebook...

MONAI vulnerable to OS command injection

Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...

CVE-2026-74895

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...