57918 matches found
MAL-2026-10711 Malicious code in @funny-booth/agent-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...
CVE-2026-46562
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the...
CVE-2026-45695
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists a...
CVE-2026-45695
The Kopia backup tool (versions prior to 0.23.0 ) is vulnerable to unauthenticated remote code execution (RCE) when the HTTP server is started with the --without-password flag. An attacker can send specially crafted requests to the /api/v1/repo/exists endpoint to inject malicious SFTP storage con...
CVE-2026-30623
A flaw was found in LiteLLM. This vulnerability allows a remote attacker to execute arbitrary operating system commands on the host where LiteLLM is running. This is possible because the application's MCP server creation functionality processes JSON configurations that can include unvalidated...
MAL-2026-10699 Malicious code in http-req-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6fcf8bb9984d83b39b69d2dbe9e0e928c5eeab345a2fb05446ab0f6e5eb1a11d The OpenSSF Package Analysis project identified 'http-req-lite' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands
Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a...
CVE-2023-49899
An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...
CVE-2023-49899
An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...
EUVD-2023-60601
An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...
CVE-2023-49899
Summary: CVE-2023-49899 affects X-Rite MAT 6 Kohinoor embedded spectrometer software. The root cause is insufficient origin validation/input validation in the communication channel, enabling a remote, unauthenticated attacker to execute commands on the device. Vulnerability details: Affected prod...
Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide
Pull the certificate off the flash of a Shark RV2320EDUS robot vacuum, and you can run root commands on other people's Shark vacuums across the same AWS region: watch the camera, drive the robot, read the map of the house, and take the Wi-Fi password in plaintext. A researcher publishing under th...
GHSA-8J86-H8GG-797P GPT Researcher MCP STDIO configuration allows remote command execution
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...
EUVD-2025-210474
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...
GPT Researcher MCP STDIO configuration allows remote command execution
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...
PT-2026-105497
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...
PT-2026-67320
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang. via Java.type because the ScriptTriggerExecutor includes java.lang. in the allowed packages. An...
MiracleLinux 9 : cockpit-356.2-1.el9_8.ML.1 (AXSA:2026-1266:11)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1266:11 advisory. cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI CVE-2026-4802 Tenable has extracted the preceding description block directl...
Vim Command Injection
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Vim Command Injection
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...