PT-2026-45723

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu2016.437.295020260327 105545 Description Server-Side Template Injection SSTI occurs when an unauthenticated attacker injects arbitrary template expressions into the server, which are then executed. This...

CVE-2026-10591: Incorrect Permission Assignment for Critical Resource

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths such as .vscode/tasks.json, enabling auto-executio...

TRENDnet TEW-432BRP Form SysCmd Command Execution

The vulnerability of the formSysCmd function in TRENDnet TEW-432BRP router microprogramming software is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow a remote attacker to execute arbitrary commands...

TRENDnet TEW-432BRP Form Wipe Command Execution

The vulnerability of the formWlanSetup function in TRENDnet TEW-432BRP router software lies in the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

router EDIMAX BR-6478AC Command Execution

The vulnerability of the formWlbasic function in the microprogrammed routing switch EDIMAX BR-6478AC lies in the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

RockyLinux 9 : vim (RLSA-2026:19224)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19224 advisory. vim: arbitrary command execution via modeline sandbox bypass CVE-2026-34982 Tenable has extracted the preceding description block directly from the RockyLinux...

RockyLinux 10 : openssh (RLSA-2026:19069)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19069 advisory. OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode CVE-2026-35385 OpenSSH: OpenSSH: Security bypass via...

CVE-2024-52011

A flaw was found in launch-editor, a tool that allows users to open files with line numbers in an editor from Node.js. Due to insufficient sanitization of the file argument in the launchEditor function, an attacker can execute arbitrary commands on Windows systems by supplying a filename that...

CVE-2026-45630

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation...

CVE-2026-45344

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escaping. A remote attacker who can reach the setup...

CVE-2024-52011

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the commitId argument in the Webhook Endpoint process. An attacker can execute arbitrary operating system commands by supplying crafted input remotely. Remediation A fix was pushed into the master branch but not ye...

CVE-2024-52011

The CVE affects the launch-editor component used with Node.js in vite prior to version 2.9.0, where insufficient sanitization of the file argument in launchEditor allowed an attacker to execute arbitrary commands on Windows by supplying a filename with special characters. The issue is resolved in...

CVE-2026-44287

FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import with the regex /\bimport\s\/.testcode. JavaScript syntax accepts a block comment between import and ; the regex matches only ASCII...

MAL-2026-5123 Malicious code in imgmatrix-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2a9f964e4264c7bcc91047fdfb9966b1ae807e1e60fafa559d5543ed6e3dc83e During import, the package executes remote commands sourced from a Google Sheet. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

PT-2026-45495

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.9.0 vite versions prior to 5.4.9 Description Insufficient sanitization of the file argument in the launchEditor function allows an attacker to execute arbitrary commands on Windows systems by providing a...

CVE-2024-52011: Improper Neutralization of Special Elements used in a Command

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters...

CowAgent operating system command injection vulnerability

CowAgent is an intelligent assistant and scalable agent framework developed by zhayujie’s individual developer. Versions of CowAgent 2.0.8 and earlier had a vulnerability related to operating system command injection. This vulnerability stems from the getsafetywarning function in the...

TOTOLINK A7100RU Router Arbitrary Command Execution

The vulnerability of the setPortalConfWeChat function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming system is related to the lack of measures taken at the management level to protect data. Exploiting this vulnerability could allow an attacker to execute...

TOTOLINK A7100RU Router Command Execution

The vulnerability of the setVpnAccountCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute arbitra...