CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which...

Command Injection

Overview node-ts-ocr is an A simple wrapper around command-line utils to assist in PDF / Image OCR Optical Character Recognition processing using Tesseract. Affected versions of this package are vulnerable to Command Injection via the invokeImageOcr function. An attacker can execute arbitrary...

Command Injection

willitmerge is vulnerable to Command Injection. The vulnerability is due to improper neutralization of user-controlled input in command execution, which allows an attacker to inject and execute arbitrary system commands through crafted input parameters...

Nocobase SQL注入漏洞

Nocobase is an open-source low-code platform developed by NocoBase. Versions of Nocobase prior to 2.0.39 contained a SQL injection vulnerability. This vulnerability stemmed from the lack of checkSQL validation for the sqlCollection:update endpoint, which could allow attackers with collection...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the manipulation of inter-site requests, allows a hacker to execute arbitrary commands.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Unity Linux 20.1050e / 20.1070e Security Update: perl-Module-ScanDeps (UTSA-2026-016505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016505 advisory. Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell...

Cross-site Scripting (XSS)

Overview @jupyterlab/rendermime is a JupyterLab - RenderMime Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute arbitrary commands, including co...

Cross-site Scripting (XSS)

Overview @jupyterlab/rendermime-interfaces is a JupyterLab - Interfaces for Mime Renderers Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute...

Cross-site Scripting (XSS)

Overview @jupyterlab/rendermime-extension is an A rendermime extension for JupyterLab Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute arbitra...

Cross-site Scripting (XSS)

Overview @jupyterlab/notebook is a JupyterLab - Notebook Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute arbitrary commands, including code...

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils-extension is a JupyterLab - Application Utilities Extension Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute...

Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xh72-v6v9-mwhc. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validatio...

CVE-2026-44109

OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling...

The vulnerability of the `system.run` command in the OpenClaw AI-agent (formerly known as ClawdBot or MoltBot) allows a attacker to execute arbitrary commands.

The vulnerability of the system.run command in the OpenClaw AI-agent formerly known as ClawdBot or MoltBot is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the VoIP gateway software Telecom MG, related to improper code generation, allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the VoIP gateway software of Telecom MG is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

The vulnerability of the telnetd.sh script of the D-Link DIR-605L router’s telnet service allows a hacker to gain unauthorized access to protected information, increase their privileges, and execute arbitrary commands.

The vulnerability of the telnetd.sh script of the D-Link DIR-605L router’s telnet service is related to the use of a static password, wrgn35dlwbrdir605l, for the Alphanetworks account. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information, enhanc...

The vulnerability of the telnetd.sh script of the D-Link DIR-605L router’s telnet service allows a hacker to gain unauthorized access to protected information, increase their privileges, and execute arbitrary commands.

The vulnerability of the telnetd.sh script of the D-Link DIR-605L router’s telnet service is related to the use of a static password, wrgn76dlwbrdir605L, for the Alphanetworks account. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information, enhance...

ROS-20260505-73-0003

Vulnerability in zabbix7-lts related to argument injection or modification. Exploitation of the vulnerability may allow an attacker to execute arbitrary commands...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the handling of raw string arguments in commands such as uidsearch, search, uidfetch, fetch, uidstore, store, and setquota. A user can execute arbitrary IMAP commands by injecting specially crafted input containing CR...

CVE-2026-7246

A flaw was found in Pallets Click. This command injection vulnerability, located in the click.edit function, allows an attacker with an unprivileged account to execute arbitrary operating system OS commands. This could lead to unauthorized control over the affected system...