EUVD-2026-94625

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to add attacker-controlled content to system-level messages on the Splunk platform instance. The...

CVE-2026-76273

Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are vulnerable to improper input validation via the collect Search Processing Language (SPL) command. An attacker with the run_collect capability can exploit the fact that the command fails to validate the index name before proc...

CVE-2026-76273 Improper Input Validation through the collect Command in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to add attacker-controlled content to system-level messages on the Splunk platform instance. The...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

GHSA-W794-RJ3P-XV45 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

EUVD-2026-92788

Langflow: OS command injection RCE via arbitrary command in MCP stdio server configuration...

CVE-2026-106057

A flaw was found in patool. This vulnerability allows an attacker to execute arbitrary commands on Windows systems. The issue occurs because the utility fails to properly escape special characters and quotes in archive filenames before passing them to the command shell. By tricking a user or syst...

EUVD-2026-82900

vm2 contains a sandbox escape vulnerability...

GHSA-4488-J8VJ-VQQV Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...

CVE-2026-106440

A flaw was found in hydra-optuna-sweeper. This vulnerability allows an attacker who controls sweep configuration settings or command-line overrides to achieve arbitrary code execution. The component dynamically resolves and invokes callable objects specified in user-controlled configuration paths...

CVE-2024-25082

⚠️ CVE-2024-25082 - FontForge ZIP Ejecución Remota de Código PoC Exploit de Prueba de Concepto para CVE-2024-25082 , una vulnerabilidad que afecta a FontForge y permite Ejecución Remota de Código RCE a través de un archivo ZIP manipulado. Este repositorio demuestra cómo se puede explotar la...

CVE-2026-93349-frictionless-command-injection

CVE-2026-93349: Frictionless = 5.20.0rc1 explore OS Command Injection Severity: High, CVSS 3.1 8.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: all Frictionless versions = 5.20.0rc1 Component: frictionless.console.commands.explore CWE: CWE-78 OS Command Injection, CWE-20 Imprope...

CVE-2026-76437

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2026-20032

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2018-1049-POC

نص بايثون هذا هو إعادة تنفيذ مخصصة لوحدة استغلال Metasploit لـ CVE-2018-1049، والتي تستهدف VyOS Vyatta عبر ثغرة تصعيد الامتيازات في سكربت Perl يُساء استخدامه من خلال sudo. تحتاج إلى بيانات اعتماد SSH صالحة. تحصل على صلاحية الجذر عبر حقن الأوامر في سكربت مسموح به عبر sudo. على الرغم من أنه يستهدف...

CVE-2019-7069-POC

استغلال تنفيذ الأوامر عن بعد في Kibana ⚠️ إخلاء مسؤولية: هذا النص البرمجي مخصص لأغراض تعليمية واختبارات الاختراق المصرح بها فقط. لا تستخدمه على أنظمة لا تملكها أو ليس لديك إذن صريح لاختبارها. المؤلف والمساهمون غير مسؤولين عن أي استخدام خاطئ أو ضرر ناتج عن هذه الأداة. 🎯 ما هذا؟ هذا نص برمجي استغلال...

EUVD-2026-57799

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium...

CVE-2026-76437 Cisco Smart Software Manager On-Prem Command Injection Vulnerability

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...