CVE-2026-55071

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the subprocess compute provider in the Worker Controller Instance module. An attacker can execute arbitrary commands on the Worker Service host by supplying a crafted compute provider configuration in their request...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the subprocess compute provider in the Worker Controller Instance module. An attacker can execute arbitrary commands on the Worker Service host by supplying a crafted compute provider configuration in their request...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071

MCP-for-Stata (stata-mcp), a Python MCP server for integrating Stata into AI agent loops, contains a command injection in its ado_package_install tool. The package argument is interpolated into an f-string in SSC_Install.install() with no sanitization, allowing newline-delimited payloads to injec...

EUVD-2026-83921

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-84285

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-84285 OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...

EUVD-2026-83901

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-84285 OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-84285

An OS Command Injection vulnerability in Tuleap Enterprise Edition (versions 17.3 through 17.5) allows a network-based attacker with low privileges to execute arbitrary commands on the server , rated CVSS 8.8 (HIGH) with full impact to confidentiality, integrity, and availability. The vulnerabili...

CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...

Exploit for CVE-2026-94095

Netcore NBR200V2 – Remote Command Injection in the Traceroute...

CVE-2026-94139

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-94139 Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-94139

A command injection vulnerability exists in the Cookie Handler component of the Chengdu Feiyuxing Technology Feiyu Star Router (version B-MB5E202-210322-r11656 ). Manipulation of the session_id argument in the file /send_order.cgi?parameter=loginout allows remote attackers to execute arbitrary co...

EUVD-2026-83832

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-94139 Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...