57801 matches found
CVE-2026-19022
A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...
CVE-2026-71312
A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows a remote attacker to execute arbitrary commands on the server when processing SFTP paths. By crafting a malicious filename that uses specific Unicode single-quote characters, an attacker can bypass...
PT-2026-76525
Summary All versions of sevenz-rust fail to validate file paths when extracting in decompress impl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such a...
CVE-2026-64654: Improper Neutralization of Escape, Meta, or Control Sequences
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...
PT-2026-68765
Name of the Vulnerable Software and Affected Versions GitHub CLI versions prior to 2.97.0 Description Multiple commands in the GitHub CLI print content from gists, APIs, pull requests, releases, codespaces, skills, or agent-tasks without neutralizing terminal escape sequences. Terminal escape...
JetBrains TeamCity Command Execution
The vulnerability of the web interface of the CI/CD application integration and delivery system JetBrains TeamCity is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security measures and execute arbitrary operati...
PT-2026-68762
Name of the Vulnerable Software and Affected Versions sysPass affected versions not specified Description The doBackupFiles function in FileBackupService.php constructs a tar shell command by concatenating the backup directory path this-path directly into the command line without using...
Missing Authorization
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
GHSA-279X-MWFV-VCQV Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...
MAL-2026-13376 Malicious code in claude-remote-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9416d15abb1ba3947af0a74a696052f6b32ec0a1d18a0e753273da4806f534ae claude-remote-agent connects to a hardcoded WebSocket server at wss://claude.pishchykau.eu and exposes the installer's host to remote control. In...
GHSA-2M8M-JHRM-W6J2 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Summary rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and...
CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...
GHSA-8C48-Q9WJ-3W37 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...
MAL-2026-13379 Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...
CVE-2026-17625 Langflow is affected by OS Command Injection in Model Context Protocol features
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...
EUVD-2026-53520
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...
CVE-2026-17625
IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special element...
CVE-2026-20288
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...
CVE-2026-20200
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...