CVE-2025-37163

A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system...

CVE-2025-61713

A Cleartext Storage of Sensitive Information in Memory vulnerability CWE-316 in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated...

CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may...

CVE-2025-54821

An Improper Privilege Management vulnerability CWE-269 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM...

CVE-2025-54821

An Improper Privilege Management vulnerability CWE-269 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3...

CVE-2025-54821

CVE-2025-54821 affects Fortinet FortiOS (versions 6.4 and 7.0–7.6.3), FortiPAM (1.0–1.6.0), and FortiProxy (7.0–7.6.3). The root cause is improper privilege management (CWE-269) that may allow an authenticated administrator to bypass the trusted-host policy via crafted CLI commands. Public source...

CVE-2025-46776

Summary (CVE-2025-46776) Fortinet FortiExtender is affected by a buffer copy without input size validation, enabling an authenticated user to execute arbitrary code or commands via crafted CLI commands. Affected versions include FortiExtender 7.6.0–7.6.1, 7.4.0–7.4.6, 7.2 all versions, and 7.0 al...

CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may...

CVE-2025-58034

CVE-2025-58034 — Fortinet FortiWeb OS Command Injection occurs in FortiWeb 8.0.0–8.0.1, 7.6.0–7.6.5, 7.4.0–7.4.10, 7.2.0–7.2.11, 7.0.0–7.0.11. The flaw is an OS command injection (CWE-78) allowing an authenticated attacker to execute arbitrary commands on the underlying system via crafted HTTP re...

PT-2025-47358

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4 through 7.6.3 Fortinet FortiPAM versions 1.0 through 1.6.0 Fortinet FortiProxy versions 7.0 through 7.6.3 Description An Improper Privilege Management issue exists that may allow an authenticated administrator to...

CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild on them, which defaults to setting shell: true. An attacker who can control the filenames being matche...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

EUVD-2025-176216

Malicious code in start-iota-webpack-cli npm...

EUVD-2025-179713

Malicious code in cli-protractor-sqlite-library npm...

EUVD-2025-176572

Malicious code in sadr-dactyl-xenon-cli npm...

EUVD-2025-177395

Malicious code in outercore-cli-concurrently-troposphere npm...

MAL-2025-189158 Malicious code in relay-tardigrade-typeorm-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e65873a2865720e808f1d146398547f6af6787ab402144f49958f3ae3b6e90 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...