Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

Cacti <=1.2.22 - Remote Command Injection

Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype This script will get you initial access. First, Install required modules using pip pip3 install -r requirements.txt Usage python3 exploit.py 'id' or python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

K000163534: Ruby vulnerabilities CVE-2026-42245, CVE-2026-42246, CVE-2026-42257

Security Advisory Description CVE-2026-42245 Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. ...

CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

PT-2026-106174

Name of the Vulnerable Software and Affected Versions CUPS affected versions not specified Description An argument injection flaw exists in the CUPS scheduler when email notification is configured. The system accepts printer subscription requests containing a mailto notify-recipient-uri, which is...

Podman Arbitrary Command Execution

The vulnerability of the pkg/machine/hyperv/stubber.go file of the OCI-container management and startup software Podman is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Kauth security subsystem DNScrypt-proxy-gui Arbitrary Command Execution

The vulnerability of the Kauth security subsystem of the DNScrypt-proxy-gui graphical interface is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

MariaDB Command Injection

The vulnerability of the MariaDB database management system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

IMAP Client API Ruby Command Injection

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

Cisco ASA OS Command Injection (CVE-2020-3167)

A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

TencentOS Server 2: sg3_utils (TSSA-2026:1086)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1086 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

MikroTik RouterOS Improper Verification of Cryptographic Signature (CVE-2026-67276)

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

CVE-2026-105767: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

Cisco ASA Command Injection (CVE-2021-1488)

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system OS. This...

ROS-20261005-73-0027

The vulnerability of the Rsync file transfer and synchronization utility is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20261005-73-0071

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-106232

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.10.3 langflow-base versions prior to 0.10.3 lfx versions prior to 1.10.3 Description An issue exists in the MCP stdio transport where the software executes commands and arguments provided in an MCP server...

PT-2026-106212

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description The SVG exporter improperly handles the fill-color value of a text object, inserting it into a ppmcolormask command string that is then executed via child process.exec. An attacker with file editing...

PT-2026-106219

Name of the Vulnerable Software and Affected Versions Chainguard Academy edu integrate-platform-docs composite GitHub Action versions from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff through commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 Description Improper neutralization of special element...