Lucene search
+L

72747 matches found

CVE
CVE
added 2026/07/20 9:50 p.m.18 views

CVE-2026-64625

CVE-2026-64625 affects AVideo before 29.0. The issue stems from an incomplete fix for CVE-2026-45578: execAsync() re-wraps escaped commands in double-quoted sh -c, enabling command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.ph...

9.8CVSS5.5AI score0.00351EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/20 9:50 p.m.5 views

CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

9.3CVSS5.6AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/20 9:50 p.m.48 views

CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

9.8CVSS0.00351EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/20 9:14 p.m.12 views

EUVD-2026-41898

Pillow: WindowsViewer.getcommand OS command injection via unescaped shell path...

4.5CVSS5.2AI score0.00177EPSS
SaveExploits1References7
OSV
OSV
added 2026/07/20 9:14 p.m.4 views

GHSA-4X4J-2G7C-83W6 Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Summary WindowsViewer.getcommand constructs a cmd.exe shell command by directly embedding a file path into an f-string without escaping. The result is passed to subprocess.Popen..., shell=True. Shell metacharacters in the file path — most importantly a double-quote " that breaks out of the...

4.5CVSS6AI score0.00177EPSS
SaveExploits1References8
NVD
NVD
added 2026/07/20 8:16 p.m.20 views

CVE-2026-63766

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

9.8CVSS0.01749EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/07/20 7:18 p.m.7 views

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

9.8CVSS5.9AI score0.01749EPSS
SaveExploits1References2
CVE
CVE
added 2026/07/20 7:18 p.m.28 views

CVE-2026-63766

GPT-SoVITS up to 20250606v2pro is vulnerable to OS command injection in webui.py. The ASR, slice, denoise and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True, allowing attackers to inject shell metacharacters via path parameters t...

9.8CVSS6AI score0.01749EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/07/20 7:18 p.m.39 views

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

9.8CVSS0.01749EPSS
SaveExploits1References2
OSV
OSV
added 2026/07/20 7:18 p.m.6 views

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

9.3CVSS6AI score
SaveExploits0References5
NVD
NVD
added 2026/07/20 7:17 p.m.10 views

CVE-2026-63108

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

8.8CVSS0.01919EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/20 6:24 p.m.6 views

CVE-2026-63108 Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

8.8CVSS5.8AI score0.01919EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/20 6:24 p.m.37 views

CVE-2026-63108 Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

8.8CVSS0.01919EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/20 6:24 p.m.10 views

EUVD-2026-46065

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

8.8CVSS5.8AI score0.01919EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/20 6:24 p.m.20 views

CVE-2026-63108

Roo Code up to 3.54.0 contains a command injection via the auto-approve execute feature. The vulnerability arises because the command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitutio...

8.8CVSS5.8AI score0.01919EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/20 5:54 p.m.11 views

EUVD-2026-46051

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

5.7AI score0.00828EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/20 4:24 p.m.35 views

CVE-2026-54051 Network-AI has an an OS Command Injection issue

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist SandboxPolicy.isCommandAllowed, which THREATMODEL.md calls the main control against a compromised agent Adversary 3.2. The allowlist glob-matches the who...

9.9CVSS0.0037EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/20 4:24 p.m.5 views

CVE-2026-54051 Network-AI has an an OS Command Injection issue

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist SandboxPolicy.isCommandAllowed, which THREATMODEL.md calls the main control against a compromised agent Adversary 3.2. The allowlist glob-matches the who...

9.9CVSS6.3AI score
SaveExploits0References4
CVE
CVE
added 2026/07/20 4:24 p.m.28 views

CVE-2026-54051

Network-AI (TypeScript/Node.js) prior to 5.9.1 is vulnerable: the agent sandbox gates shell commands via an allowlist, but ShellExecutor runs commands through /bin/sh -c. Wildcards like git *, npm *, or node * can match unintended strings (e.g., git status; …), enabling arbitrary code execution i...

9.9CVSS6.2AI score0.0037EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/20 12:17 p.m.15 views

CVE-2026-14448

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

8.6CVSS0.00765EPSS
SaveExploits0References2
Rows per page
Query Builder