CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints...

CVE-2025-20309 Cisco Unified Communications Manager Static SSH Credentials Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that...

CVE-2025-20308

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

CVE-2025-20308

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

CVE-2025-20308 Cisco Spaces Connector Privilege Escalation Vulnerability

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

CVE-2025-20308

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

CVE-2025-20308

CVE-2025-20308 affects Cisco Spaces Connector. An authenticated, local attacker with spacesadmin privileges can run a crafted CLI command to elevate privileges and execute arbitrary commands on the underlying OS as root. The root cause is insufficient restrictions during the execution of specific...

Cisco Spaces Connector Privilege Escalation Vulnerability

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

CVE-2025-24333 Administrative user shell input validation fault

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added...

Command Execution Vulnerability in MSG2200 at Resconda Technology Development Co.

Ltd. is an industry-leading provider of optical networking products and system solutions. A command execution vulnerability exists in the MSG2200 of Riseconda Technology Development Corporation, which can be exploited by an attacker to execute arbitrary commands...

CVE-2025-41656

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

CVE-2025-41656

CVE-2025-41656 concerns the Pilz IndustrialPI Node-RED integration, where the authentication for the Node-RED server is not configured by default. This allows an unauthenticated remote attacker to execute arbitrary commands with high privileges on affected devices. The CVSS 3.1 base score is 10.0...

CVE-2025-41656 Pilz: Missing Authentication in Node-RED integration

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Sudo vulnerabilities (USN-7604-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7604-1 advisory. Rich Mirch discovered that Sudo incorrectly handled the host option. In environments where per-host rules are configured in t...

CVE-2025-49520 Event-driven-ansible: authenticated argument injection in git url in eda project creation

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift...

USN-7604-1: Sudo vulnerabilities

Rich Mirch discovered that Sudo incorrectly handled the host option. In environments where per-host rules are configured in the sudoers file, a local attacker could use this issue to bypass the host restrictions. CVE-2025-32462 Rich Mirch discovered that Sudo incorrectly handled the chroot option...

CVE-2025-6522

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string...

CVE-2025-53098

Roo Code prior to version 3.20.3 stores the MCP configuration in .roo/mcp.json. The MCP config format allows executing arbitrary commands, enabling an attacker who can submit prompts (e.g., via prompt injection) and who has MCP enabled and auto-approve file writes turned on to inject a malicious ...

CVE-2025-6522

CVE-2025-6522 affects TrendMakers Sight Bulb Pro. An unauthenticated adversary on an adjacent network can execute arbitrary commands as root via a vulnerable proprietary TCP protocol on port 16668 by sending a well-formed JSON string. This is described as a command-injection vulnerability in the ...

CVE-2025-6522 TrendMakers Sight Bulb Pro Command Injection

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string...