58903 matches found
postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN
A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...
CVE-2026-91800
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS . The vulnerability is caused by insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this flaw to execute arbitrary commands...
EUVD-2026-85122
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...
postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN
A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...
CVE-2026-50227 MQTT WebSocket Command Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...
CVE-2026-50227
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62 ). This vulnerability allows the attacker to invoke exposed ddsc RPC functions , specifically child_process.execSync() , which ca...
EUVD-2026-85151
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...
CVE-2026-50227 MQTT WebSocket Command Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...
Malicious code in n8n-nodes-metricsagent (npm)
Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and swallows errors via try/catch. index.js runs init at top level...
Malicious code in moudeva (npm)
Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoint https://ipc.shadxino.internal referenced at lines 359 a...
Malicious code in n8n-nodes-healthmon (npm)
Source: amazon-inspector 7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and passes the c field directly to childprocess.exec, giving...
Malicious code in moudeva (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoi...
Malicious code in n8n-nodes-healthmon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and...
MAL-2026-16444 Malicious code in n8n-nodes-healthmon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and...
Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
EUVD-2026-84947
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...
EUVD-2026-84960
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere...
EUVD-2026-84977
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
EUVD-2026-84972
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...