Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

MAL-2026-17502 Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

CentOS Linux 6 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS6:CLSA-2026:1777038917)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777038917 advisory. - A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 t...

PT-2026-102812

Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 4.0.0 Description The default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. This allows an attacker to execute arbitrary shell commands with the operating-system...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

EUVD-2026-88391

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

MAL-2026-17175 Malicious code in n8n-nodes-flowstats (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aa25eb3d56eb14b75cbb4dedbd5d09063e4b742b53acef9a4096cc77213b8f3 The package presents itself as an n8n community node that annotates items with flow statistics, but nodes/FlowStats.node.js contains two independent...

CVE-2026-45018

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-75911: Improper Control of Generation of Code

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

Missing Authorization

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

GHSA: Unauthenticated Remote Code Execution via found-action in Dalfox Server Mode Summary When dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options —...

PT-2026-6663

Summary 1. There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an admin if they click a specially crafted link. 2. Additionally, there is a Command Injection vulnerability in GET /admin/backup. Th...

EUVD-2021-13408

Malware in sbrugna...

EUVD-2018-0740

Malware in sbrugna...

PT-2024-33486

Name of the Vulnerable Software and Affected Versions Joplin-desktop affected versions not specified Description The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid, allowing the execution of untrusted HTML content within the Electron window. This enables...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache ActiveMQ vulnerabilities (USN-6910-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6910-1 advisory. Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain commands. A remote attacker could possibly...

Mageia: Security Advisory (MGASA-2024-0237)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...