8151 matches found
CVE-2026-31995
OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...
CVE-2026-31995 OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension
OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...
CVE-2026-31995 OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension
OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...
CVE-2026-31995: Improper Neutralization of Special Elements used in an OS Command
OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true,...
PT-2026-26485
Name of the Vulnerable Software and Affected Versions dagu versions 2.0.0 through 2.3.0 Description Dagu suffers from a path traversal issue due to incomplete fixes for CVE-2026-27598. The initial fix addressed path traversal in the CreateNewDAG function, but the locateDAG function still allows...
net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.577)
org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...
com.nirima.jenkins.repository:jenkins-maven-plugin (1.3), com.nirima.jenkins.repository:pom (1.3) +39 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.609.2)
org.jenkins-ci.main:jenkins-core MAVEN version 1.609.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.3 - com.nirima.jenkins.repository:pom 1....
Malicious code in env-workflow-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c69ec15e609dd6c0e6dacd007a2467cc5e24a118f60cca22ec48c3b8225c4df The package env-workflow-test was found to contain malicious code...
MAL-2026-1725 Malicious code in env-workflow-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c69ec15e609dd6c0e6dacd007a2467cc5e24a118f60cca22ec48c3b8225c4df The package env-workflow-test was found to contain malicious code...
EUVD-2026-12788
A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters that overflow a fixed-size stack buffer within an internal process, resulting in a DoS attack...
CVE-2026-22317
A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges...
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
The sanitizeArchivePath function in pkg/extract/extract.go lines 248–254 is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory when using the extractor CLI...
EUVD-2025-208658
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow...
CVE-2025-13459
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow...
About the Remote Code Execution Vulnerability - n8n (CVE-2025-68613)
About Remote Code Execution Vulnerability - n8n CVE-2025-68613. n8n is a workflow automation platform available under a fair-code license. Improper Control of Dynamically-Managed Code Resources CWE-913 in the n8n workflow expression evaluation system allows a remote authenticated attacker without...
CVE-2025-13459: Improper Enforcement of Behavioral Workflow
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow...
CVE-2026-31882
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication DAGUAUTHMODE=basic, all Server-Sent Events SSE endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG...
CVE-2026-31886
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves...
CVE-2025-13459
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow...
CVE-2025-13459 IBM Aspera Console Denial of Service
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow...