EUVD-2026-93421

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105788

The Microsoft UFO open-source framework is vulnerable to authenticated Android shell command injection in versions prior to 3.0.10 . The flaw exists in the type_text and launch_app tools within ufo/client/mcp/http_servers/mobile_mcp_server.py, where the text and package_name parameters are passed...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

EUVD-2026-93405

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105788

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-85523 OS Command Injection in Felisify Informatics' SambaBox

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

EUVD-2026-93399

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-85523

SambaBox by Felisify Information Technologies Industry and Trade Inc. is vulnerable to OS Command Injection due to the improper neutralization of special elements used in an OS command (CWE-78 ). This issue affects versions before 5.4.1 . An attacker could potentially execute arbitrary commands o...

CVE-2026-34498 L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-34498

An improper input validation vulnerability exists in Johnson Controls Illustra Standard - L4L China on Windows platforms. This flaw allows for OS Command Injection , specifically affecting versions before 6.0.0.66394 . The documents do not provide specific technical details regarding the vulnerab...

EUVD-2026-93398

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-91140

The Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability (CWE-78) within its shell-based temporary-file cleanup instructions. An attacker can execute arbitrary commands on a developer's machine by providing a crafte...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

EUVD-2026-93397

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...