EUVD-2026-77773

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The...

CVE-2026-90813

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The...

CVE-2026-90813

CVE-2026-90813 affects cosmicstack-labs mercury-agent versions up to 1.1.13 . The vulnerable component is the Shell Command Execution function checkShellCommand in src/capabilities/permissions.ts. The root cause is an incorrect behavior order: validation occurs before canonicalization , allowing ...

CVE-2026-90813 cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The...

CVE-2026-90813 cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The...

CVE-2026-90813 cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The...

Vulnerability exposure in Cisco Secure Email Gateway

Cisco has identified a vulnerability in Cisco Secure Email Gateway. This vulnerability lies in the processing of email messages within the Cisco AsyncOS software for Cisco Secure Email Gateway. It arises due to insufficient validation of incoming email messages. An unauthorized malicious actor ca...

CVE-2026-90809 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

CVE-2026-76461

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

CVE-2026-59960

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

CVE-2026-57124

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

EUVD-2026-77625

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

CVE-2026-76461

A SQL injection vulnerability in the email parsing logic of Cisco AsyncOS Software for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to send a crafted email containing malicious SQL statements, leading to arbitrary command execution with root privileges on the underlying o...

Environment Module Command Injection Vulnerability

Environment modules have a command injection vulnerability. This vulnerability arises when a local attacker places a maliciously named modulefile in a visible location within the victim’s MODULEPATH. When the victim uses Bash completion for the module or the ml command, the malicious module name,...

Cisco Secure Email Gateway SQL Injection Vulnerability

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

CVE-2025-24890

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

CVE-2026-57125

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...