59247 matches found
Droplet Agent security vulnerability
Droplet Agent is an open-source tool developed by DigitalOcean for managing and monitoring DigitalOcean Droplets. Versions of Droplet Agent prior to 1.3.2 contain security vulnerabilities. These vulnerabilities stem from the fault diagnosis executor component failing to properly validate inputs...
CVE-2026-33482: Improper Neutralization of Special Elements used in an OS Command
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters &&, ;, |, , . However, it fails ...
PT-2026-27217
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP Model Context Protocol server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4...
EcoStruxure Automation Expert Arbitrary Command Execution
The vulnerability of the EcoStruxure Automation Expert software for automating manufacturing processes is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary commands and gain full control over the system...
TP-Link’s various products have security vulnerabilities
TP-LINK Archer is a series of routers produced by TP-LINK Corporation. Several TP-Link products have security vulnerabilities. These vulnerabilities stem from improper handling of wireless control management CLI commands. This could allow authenticated attackers with administrative privileges to...
Windows Routing and Remote Access Service integer overflow
Added: 03/23/2026 Background The Windows Routing and Remote Access Service supports remote user or site-to-site connectivity by using VPN or dial-up connections. Problem An integer overflow vulnerability in the Windows Routing and Remote Access Service allow command execution when a domain-joined...
Siemens APE1808 Incorrect Provision of Specified Functionality (CVE-2025-58325)
An Incorrect Provision of Specified Functionality vulnerability CWE-684 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands. This plugin only works with...
CVE-2026-24516
A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner component internal/troubleshooting/actioner/actioner.go processes metadata from the metadata service endpoint and executes commands specified in the TroubleshootingAgent.Requesting...
CVE-2026-33648: Improper Neutralization of Special Elements used in an OS Command
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled usersid and liveTransmitionHistoryid values from the JSON request body without any sanitization. This log file path is then...
PT-2026-27164
Name of the Vulnerable Software and Affected Versions TP-Link Archer NX200 TP-Link Archer NX210 TP-Link Archer NX500 TP-Link Archer NX600 Description A flaw exists in how input is handled within an administrative command-line interface CLI used for modem management. This allows a specially crafte...
VulnCheck KEV: CVE-2020-9374
On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metacharacters to the panel's traceroute feature...
CVE-2026-33319
WWBN AVideo is an open source video platform. Prior to version 26.0, the uploadVideoToLinkedIn method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg. If an attacke...
CVE-2026-33319
WWBN AVideo is an open source video platform. Prior to version 26.0, the uploadVideoToLinkedIn method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg. If an attacke...
Malicious code in @mesh-components/customthemeprovider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b2e29319a8cb96867858b20a43a684624167dc62c186de47de7e7e7e8c8a2a The package @mesh-components/customthemeprovider was found to contain malicious code. Source: ossf-package-analysis...
Exploit for OS Command Injection in Arcane
CVE-2026-23520 A proof‑of‑concept exploit demonstrat...
Malicious code in thisismytest (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a1c269bbb834081025da993697e3e2e44db4a97e16e21f4c792ed85391772fa9 During installation, the package downloads and runs a remote executable, which is identified as a backdoor. It connects with a remote server and executes basic...
MAL-2026-2011 Malicious code in cms-catalogue (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d08a53064a76469a8b5ab4afdb3aa2907127f26f98ac8255e3ae650f8ce5d1ba The package cms-catalogue was found to contain malicious code. Source: ossf-package-analysis...
CVE-2026-32065 OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to...
CVE-2026-32065
Summary (concrete): CVE-2026-32065 affects OpenClaw
CVE-2026-32065
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to...