57923 matches found
CVE-2026-14852: Improper Neutralization of Special Elements used in an OS Command
Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database...
ROS-20260714-73-0067
The vulnerability in ZooKeeper is related to the incorrect processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
openSUSE 16 Security Update : gh (openSUSE-SU-2026:21310-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21310-1 advisory. Changes in gh: - Update to version 2.96.0: Critical security fix: patched vulnerability in gh codespace jupyter that could allow command executi...
PT-2026-63410
Name of the Vulnerable Software and Affected Versions Check Point Security Management affected versions not specified Multi-Domain Security Management affected versions not specified Description An authentication bypass allows an unauthenticated remote attacker to execute administrative commands ...
PT-2026-58109
Name of the Vulnerable Software and Affected Versions Archer VX1800v version v1 Description An OS command injection issue exists in the TR-069 / CWMP management interface. This occurs because of insufficient input validation and sanitization of parameters, which allows crafted input to be execute...
SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution
This module exploits a Server-Side Request Forgery SSRF vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to execute...
Malicious code in n8n-nodes-rce-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c735b8bb20a784446d7a0a4c49369ca3f2696bfe2e8a004799c763fc0a064aca On require by n8n module-load, top-level code in dist/RceNode.node.js, the package runs a shell command via execSync'/bin/sh',.... The command is tak...
MAL-2026-10503 Malicious code in n8n-nodes-rce-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c735b8bb20a784446d7a0a4c49369ca3f2696bfe2e8a004799c763fc0a064aca On require by n8n module-load, top-level code in dist/RceNode.node.js, the package runs a shell command via execSync'/bin/sh',.... The command is tak...
Malicious code in node-fsmetrics-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9958558a30dea32a3b0fc2e48bb775433e1f12b339030a8d21872ad058bc28ff On require, index.js hex-decodes the URL http://152.53.120.90/cmd and starts a background loop that polls /cmd/commands, executes returned strings vi...
Malicious code in node-sysmon-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33 On module load, index.js reconstructs a hex-encoded URL Buffer.from'687474703a2f2f3135322e35332e3132302e39302f636d64','hex' that decodes to...
MAL-2026-10465 Malicious code in node-sysmon-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33 On module load, index.js reconstructs a hex-encoded URL Buffer.from'687474703a2f2f3135322e35332e3132302e39302f636d64','hex' that decodes to...
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
SummaryThe securepopen function in glances/secure.py interprets file redirection, | pipe, and && command chaining operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.When Application Monitoring Process AMP...
LiteLLM: Authenticated command execution via MCP stdio test endpoints
ImpactTwo endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...
stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution...
PYSEC-2026-3076 stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution...
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
Summaryrunpython in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "" and passing it to subprocess.run..., shell=True. The escaping logic only handles \ and ", leaving $ and backtick substitutions unescaped, allowing arbitrary OS command executio...
FastMCP has a Command Injection vulnerability - Gemini CLI
Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
SummaryWhen yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. Impactyt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses...
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract t...
PYSEC-2026-2864 pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract t...