11797 matches found
D-Link DIR-605L Router Authentication Bypass
The vulnerability of the D-Link DIR-605L router’s microprogramming software is related to the absence of authentication for critical functions. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
PT-2026-23878
Name of the Vulnerable Software and Affected Versions Git versions prior to 1:2.25.1-1ubuntu3.14+esm4 Description Git incorrectly handled certain repository paths in platforms with multiple users support. This could allow an attacker to run arbitrary commands. The initial safety checks introduced...
browserstack-local Node.js Command Execution
The vulnerability of the logfile parameter in the lib/Local.js library of the npm package browserstack-local for the Node.js software platform is related to improper code generation management. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...
n8n Command Injection
The vulnerability of the n8n automation platform exists because measures are not taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands or read arbitrary files remotely...
CVE-2026-23678 Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker wi...
SUSE CVE-2026-26280
systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the wifiNetworks function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In...
CVE-2026-26320
Summary: CVE-2026-26320 affects OpenClaw macOS desktop client versions 2026.2.6–2026.2.13. The app registers the openclaw:// URL scheme and, for openclaw://agent deep links without an unattended key, shows a truncated confirmation dialog (first 240 characters) but executes the full message after ...
CVE-2026-26320
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the "openclaw://" URL scheme. For "openclaw://agent" deep links without an unattended "key", the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the fu...
CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
CVE-2026-26189
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in "aquasecurity/trivy-action" versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...
CVE-2025-4960
CVE-2025-4960 affects macOS via the EPSON printer driver installer’s com.epson.InstallNavi.helper, which exposes privileged functionality due to improper authorization handling and weak client authentication over XPC. The API flow uses overly permissive custom rights registered in /var/db/auth.db...
CVE-2026-26320: User Interface (UI) Misrepresentation of Critical Information
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
CVE-2026-26189: Improper Neutralization of Special Elements used in an OS Command
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...
Trivy Action operating system command injection vulnerability
Trivy Action is a container vulnerability scanning tool developed by Aqua Security. Versions of Trivy Action prior to 0.33.1 contain an operating system command injection vulnerability. This vulnerability arises from improper handling of input during the process of exporting environment variables...
CVE-2025-13689 DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment
IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads...
PT-2026-20950
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.6 through 2026.2.13 Description The OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links lacking an unattended key, the application displays a confirmation dialog...
CVE-2025-13689: Unrestricted Upload of File with Dangerous Type
IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads...
PT-2026-20225
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data affected versions not specified Description An authenticated user may be able to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads. Recommendations At the...
Advisory ROSA-SA-2026-3204
Software: vim 8.0.1763 OS: ROSA Virtualization 2.1 unaffected versions = vim-8.0.1763-21.0.1.rv3 affected versions vim-8.0.1763-21.0.0.1.rv3 CVE-ID: CVE-2025-53905 BDU-ID: 2025-11730 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the vim text editor is related to an incorrect restriction of the...
