MAL-2026-975 Malicious code in azure-postgresql-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bed0aaccd7198eac8f4076c1eec5f143ae28bdcfa8bbf990a62ff7c65411707 The package azure-postgresql-auth was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-20761

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device...

CVE-2026-20761

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device...

CVE-2026-20761 EnOcean SmartServer IoT Command Injection

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device...

MAL-2026-951 Malicious code in printrables (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 062cd723b198a3d0af641a78b343642653fb80f4cbf527be765bb4e520cbd3ed Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

📄 Splunk Enterprise 8.2.9 / 9.0.2 Authenticated Remote Code Execution

Proof of concept exploit for CVE-2022-43571, a critical authenticated remote code execution vulnerability affecting Splunk Enterprise versions 8.2.9 and 9.0.2. The flaw resides in the SimpleXML dashboard PDF generation process, where insufficient input sanitization allows a privileged authenticat...

MCP Server Arbitrary Command Execution

The vulnerability of the MCP server regarding the execution of container code via node-code-sandbox-mcp is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary system commands...

CVE-2026-20761: Improper Neutralization of Special Elements used in a Command

A vulnerability exists in EnOcean SmartServer IoT version 4.60.009 and prior, which would allow remote attackers, in the LON IP-852 management messages, to send specially crafted IP-852 messages resulting in arbitrary OS command execution on the device...

Dell Unisphere SQL Injection

The vulnerability of the data processing application Dell Unisphere for PowerMax and the virtualization software Dell Unisphere for PowerMax Virtual Appliance is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute...

Brocade Fabric OS < 9.2.1c2 / 9.2.2 < 9.2.2b Multiple Vulnerabilities

The version of Brocade FabricOS installed on the remote host is prior to 9.2.1c2, or 9.2.2 prior to 9.2.2b. It is, therefore, affected by multiple vulnerabilities: - A vulnerability in Brocade Fabric OS could allow an authenticated attacker with admin privileges using the shell commands source,...

Smanga security vulnerabilities

Smanga is a Docker-based comic streaming reading tool developed by lkw199711. Version 3.2.7 of Smanga has a security vulnerability. This vulnerability stems from improper handling of the mediaId parameter in the /php/path/rescan.php interface. It could allow unverified attackers to inject operati...

Wavlink Router Arbitrary Command Execution

The vulnerability of the /cgi-bin/login.cgi file in the microprogramming software for Wavlink WL-WN579A3 is related to the lack of measures taken to neutralize data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

D-link DIR-823X DDNS Service Arbitrary Command Execution

The vulnerability of the /goform/setddns file of the DDNS Service component of the D-link DIR-823X router microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the parameters ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd...

Wavlink Delete_Mac_list Command Execution

The vulnerability of the DeleteMaclist function in the /cgi-bin/wireless.cgi file of the Wavlink WL-WN579A3 router’s microprogramming system is related to the lack of measures taken to neutralize such data at the control level. Exploiting this vulnerability could allow a malicious actor to execut...

Wavlink WL-WN579A3 system multi_ssid Command Execution

The vulnerability of the multissid function in the /cgi-bin/wireless.cgi file of the Wavlink WL-WN579A3 router microprogramming system is related to the lack of measures taken to neutralize data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary...

Tenda AC1206 Router Arbitrary Command Execution

The vulnerability of the httpd component of the formBehaviorManager function in the Tenda AC1206 router microprogramming system is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability may allow an attacker to execute arbitrary commands remotely...

CVE-2026-26325

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between "rawCommand" and "command" in the node host "system.run" handler could cause allowlist/approval evaluation to be performed on one command while executing a different argv. This only impacts deployments that use th...

CVE-2026-26323

CVE-2026-26323 overview : OpenClaw’s maintainer/updater script in source checkouts (versions 2026.1.8–2026.2.13) is vulnerable to OS command injection. The script update-clawcontributors.ts builds a shell command from git author metadata (via execSync) and interpolates a GitHub login, which can b...

CVE-2026-26320

Summary: CVE-2026-26320 affects OpenClaw macOS desktop client versions 2026.2.6–2026.2.13. The app registers the openclaw:// URL scheme and, for openclaw://agent deep links without an unattended key, shows a truncated confirmation dialog (first 240 characters) but executes the full message after ...

CVE-2026-26320

OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...