CVE-2026-101880: Incorrect Authorization

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CVE-2026-103473: Improper Neutralization of Special Elements used in an OS Command

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-51858

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

CVE-2026-51858

The camel-ai camel software versions v0.2.91a1 , v0.2.91a2 , and v0.2.91a3 are vulnerable to arbitrary shell command execution. The root cause is located in the TerminalToolkit.shell_exec function, which allows prompt-driven command execution without an approval boundary . This flaw falls under C...

CVE-2026-51870

DeepTutor version 1.4.0 is vulnerable to OS command injection within the execute function of the /tutorbot/agent/tools/shell.py:ExecTool component. This flaw allows for remote command execution due to the improper neutralization of special elements used in an OS command. While the CVSS v3.1 score...

CVE-2026-51858

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

EUVD-2026-90422

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

PT-2026-103301

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.2 JetBrains TeamCity versions prior to 2026.1.4 JetBrains TeamCity versions prior to 2025.11.8 Description Authenticated users can execute arbitrary commands on Windows servers. This is possible throug...

PT-2026-103537

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An improper restriction of a user-supplied file path in an administrative export feature allows an authenticated administrator to write a file to an arbitrary location on the underlying host...

PT-2026-103618

Name of the Vulnerable Software and Affected Versions DeepTutor version 1.4.0 Description An OS command injection issue exists in the execute function within the /tutorbot/agent/tools/shell.py:ExecTool component, allowing for remote command execution. Recommendations At the moment, there is no...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

CVE-2026-102099: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially...

PT-2026-103515

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incorrect authorization issue exists in the system.run exec-approval policy. The ExecShellWrapperParser function fails to properly split commands on pipe operators or extract...

CVE-2026-51870: Improper Neutralization of Special Elements used in an OS Command

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

CVE-2026-51858

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

Linux Distros Unpatched Vulnerability : CVE-2026-102422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any...

AlmaLinux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.6:CLSA-2026:1789034846)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789034846 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacke...

Rocky Linux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.6:CLSA-2026:1789034846)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789034846 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782204526)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782204526 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use t...