11425 matches found
CVE-2025-51820
CVE-2025-51820 A critical Remote Code Execution RCE vulnerability CVE-2025-51820 has been discovered in the Shopping Portal v1.0. 🚨 Remote Code Execution in Online Shopping Portal Project v1.0 CVE-2025-51820 🔍 Introduction In today’s digital world, Remote Code Execution RCE remains one of the mos...
CVE-2025-26056
CVE-2025-26056 Auhtor: Rohan Deshpande OS Command Injection Summary OS command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application. This can lead to unauthorized access, data breaches, and system...
Linux Distros Unpatched Vulnerability : CVE-2026-30971
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated...
AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792217772)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792217772 advisory. - vim is vulnerable to Use After Free CVE-2021-4187 - Vim is an open source, command line text editor. Prior to 9.2.0845,...
Exploit for OS Command Injection in Gnu Bash
CVE-2014-6271 Shellshock xpl0ited by infrar3dhttps://githu...
CVE-2026-96620
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in...
CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...
CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...
CVE-2026-96620
The Claude Agent SDK (a Python SDK for Claude Code) is vulnerable to argument injection in versions prior to 0.2.121 . The root cause is the lack of validation on the resume option , where a dash-leading value is incorrectly parsed as an independent CLI flag. An attacker providing untrusted input...
EUVD-2026-103155
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...
EUVD-2026-103151
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...
MAL-2026-17907 Malicious code in @beloved-lenora/opencode-shell-guard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8dd8daa41992a2f1dec185b6924f6cc81b7172b55cccd6930f062317984ba8 The package presents itself as a safety guard that reviews shell commands before execution, but contains an undocumented branch that activates when t...
SUSE CVE-2026-104024
Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...
CVE-2026-96620: Improper Input Validation
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...
PT-2026-116154
Name of the Vulnerable Software and Affected Versions Claude Agent SDK versions prior to 0.2.121 Description An issue exists where the resume option is passed to the Claude CLI as a separate token without validation. This allows a value starting with a dash to be parsed as an independent CLI flag...
PT-2026-116144
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...
RockyLinux 8 : lrzsz (RLSA-2026:83525)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83525 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...
GHSA-G74G-RG72-J2P3 mise permits untrusted local configuration to override default shell arguments
Summary Untrusted local .mise.toml settings can set the shell interpreter args unix/windows defaultinline / defaultfile shellargs, yielding arbitrary command execution, because those command-interpreter settings were not added to the globalonly denylist the CVE-2026-55448 fix relies on. Code...
mise permits untrusted local configuration to override default shell arguments
Summary Untrusted local .mise.toml settings can set the shell interpreter args unix/windows defaultinline / defaultfile shellargs, yielding arbitrary command execution, because those command-interpreter settings were not added to the globalonly denylist the CVE-2026-55448 fix relies on. Code...