CVE-2026-84278

IBM Security Guardium Data Protection version 12.2 is vulnerable to a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands via attacker-controlled arguments, leading to command execution with root privil...

CVE-2026-84278 IBM Guardium Data Protection Command Injection

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

EUVD-2026-95166

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

tlsenum

tlsenum tlsenum is a command-line TLS enumeration tool that attempts to enumerate what TLS cipher suites a server supports and list them in order of priority. It works by sending out sending out TLS ClientHello messages and parsing the ServerHello responses from the server. tlsenum assumes that t...

r2s

React2Shell R2S - CVE-2025-55182 Testing Tool Advanced exploitation testing tool for CVE-2025-55182 vulnerability assessment Features • Installation • Usage • Testing Environment • Legal 📖 What is R2S? R2S React2Shell is a security testing tool designed to help security researchers, developers, a...

gcat

Gcat Una backdoor furtiva basata su Python che utilizza Gmail come server di comando e controllo Questo progetto è ispirato al codice PoC originale di Benjamin Donnelly Questo è codice PoC... ... che è stato rilasciato per consentire alle organizzazioni di testare le proprie difese contro questi...

CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

CVE-2026-107322

The Amazon Agent Plugins for AWS databases-on-aws plugin, in versions prior to 1.7.1 , is vulnerable to an OS command injection (CWE-184). An attacker can execute arbitrary operating system commands on the host running the helper by providing a crafted database command value within the agent cont...

EUVD-2026-95151

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent contex...

FortiSandbox-RCE-Exploit-CVE-2026-39808

FortiSandbox RCE Scanner — CVE-2026-39808 Unauthenticated OS Command Injection as root in Fortinet FortiSandbox Vulnerability • Installation • Usage • How It Works • Pipeline • Shodan Dorks • Disclaimer Vulnerability CVE-2026-39808 is a critical unauthenticated OS command injection vulnerability ...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

EUVD-2026-95149

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains an OS command injection vulnerability in the ImageOptimizer#identify_format function. When the identify option is enabled, an attacker who can control the image path—such as through an uploaded file name—can append shell metachara...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107699

The ppt2png utility (versions through 0.0.6 ) is vulnerable to an OS command injection vulnerability. The root cause is the use of unsanitized input or output path arguments in the ppt2png.js file, specifically where shell metacharacters (e.g., ';' ) are passed to child_process.exec() . This allo...