CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

WordPress MW WP Form plugin < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin MW WP Form versions 5.1.5...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

PT-2026-83998

Name of the Vulnerable Software and Affected Versions MetaGPT version 0.8.1 Description An OS command injection flaw exists where the rebuild class views function in metagpt/repo parser.py interpolates the path argument into a shell command using shell=True without using an argument list. This...

CVE-2026-55673

PowSyBl (Power System Blocks), a framework for building power system software, is affected by a command injection vulnerability prior to version 7.2.2. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor components concatenate attacker-controlled arguments and environment variables into ...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

WordPress AI Engine plugin 3.4.0-3.7.1 - Unauthenticated Arbitrary AI Query Execution vulnerability

Unauthenticated Arbitrary AI Query Execution vulnerability discovered by Abdullah Kareem in WordPress Plugin AI Engine versions 3.4.0-3.7.1...

EUVD-2026-67772

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-83127

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-76230

A flaw was found in Renovate. This vulnerability, a command injection, exists within the npm manager due to improper sanitization of user-provided package names. An attacker with write access to a repository can exploit this by crafting malicious Renovate configuration files. This allows them to...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35868

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-link Router AC2100_AZ3 V1.0.4 . The root cause is the insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution conte...

CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2025-29278

CVE-2025-29278 Proof of Concept PoC: Nella scheda Diagnostica, vai allo strumento Tracert e, nel campo Host Address, inserisci un indirizzo IP valido seguito da un punto e virgola ; e il comando desiderato. Questa iniezione consente l'esecuzione arbitraria di comandi sul sistema. Esempio di...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104833 advisory. A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets...

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

Summary mcp-shell ships a default Docker configuration security.yaml that includes /bin/bash in the allowedexecutables allowlist. The command validator security.go only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell...