10381 matches found
CVE-2026-16932 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...
[SECURITY] [DSA 6453-1] libgit2 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/security/ Aron Xu August 20, 2026 https://www.debian.org/security/faq -...
CVE-2026-18482
Neo.mjs is affected by a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server. The issue stems from the checkSyntax() and runPlaywrightTest() functions unsafely interpolating caller-controlled absolutePath values into shell command...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
EUVD-2026-63266
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
Malicious code in @httttt/mcp-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ee4beb2634f91de84901fbeb18674445c67c33a45c93a6509f72e03fe1a01b6 The package registers an MCP tool named execcommand that accepts a command string argument from the connected MCP client and passes it directly to...
EUVD-2026-62969
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
CVE-2026-54449: Improper Neutralization of Special Elements used in a Command
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...
CVE-2026-18835: Improper Neutralization of Special Elements used in an OS Command
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.
The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
PT-2026-79171
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper privilege management may allow a local attacker to execute arbitrary commands. Recommendations At the moment, there is no information about a newer version that...
PT-2026-78899
Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0101 Description An OS command injection flaw exists due to insufficient input filtering. This allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands, which...
PT-2026-79035
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...
CVE-2026-77077: Improper Control of Generation of Code
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
PT-2026-79136
Name of the Vulnerable Software and Affected Versions OTRS Community Edition affected versions not specified Description An authenticated OS command injection exists in the PGP encryption module. This issue occurs because configuration values provided by administrators are concatenated into a she...
CVE-2026-76404
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...
CVE-2026-76349
In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...
CVE-2026-76255 Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...
EUVD-2026-62858
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
