186840 matches found
EUVD-2026-94325
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...
CVE-2025-54123
CVE-2025-54123 Hoverfly 命令注入到 RCE PoC 概述 该仓库包含一个用于与受 CVE-2025-54123 影响的 Hoverfly 实例进行交互的 Python 概念验证（PoC）脚本。 脚本支持： 使用用户名/密码凭证进行身份验证 使用现有的 Bearer 令牌进行身份验证 与 Hoverfly 中间件 API 端点进行交互 显示 API 响应输出 警告 本项目仅用于经授权的安全研究、测试和教育目的。未经明确许可，请勿将其用于任何系统。 依赖 Python 3.8+ requests 安装依赖： pip install requests 使用...
vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion
A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...
Important: Red Hat Security Advisory: vim security update
An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
CVE-2026-106059
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...
CVE-2026-106057
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...
CVE-2026-106058
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...
CVE-2026-106056
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...
CVE-2026-106059
GitAhead versions through 2.7.1 on macOS are vulnerable to a command injection vulnerability (CWE-78). The root cause is the unescaped interpolation of repository filenames into the Show in Finder AppleScript . An attacker can execute arbitrary shell commands by committing a file with a path cont...
EUVD-2026-94307
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...
CVE-2026-106059 GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...
CVE-2026-106059 GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...
EUVD-2026-94306
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...
CVE-2026-106058
GitAhead versions up to and including 2.7.1 are vulnerable to an OS command injection in the src/git/Filter.cpp component. The flaw exists because malicious repositories can execute arbitrary commands by substituting crafted filenames into clean/smudge filter commands. Specifically, an attacker c...
CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...
CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...
CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...
CVE-2026-106057
Versions of patool prior to 4.0.6 are vulnerable to an OS command injection vulnerability on Windows . The issue stems from the shell_quote_nt function failing to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. An attacker can exploit this by providing c...
EUVD-2026-94305
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...
CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...