189489 matches found
CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...
CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...
EUVD-2026-88397
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...
EUVD-2026-88391
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...
CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...
CVE-2026-75600
FreePBX, an open-source IP PBX, is vulnerable to Host Command Injection in versions prior to 17.0.9 . The vulnerability exists in the GraphQL api module's documentation generator , which accepts an authenticated host parameter and incorporates it into a shell command without proper validation or ...
CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...
CVE-2026-54674
The FreePBX open source IP PBX is vulnerable to authenticated command injection in the User Control Panel (UCP) interface prior to versions 16.0.39 and 17.0.7 . The root cause is insufficient sanitization of specific URL parameters, which allows an authenticated user to execute arbitrary commands...
CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...
EUVD-2026-88386
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...
CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...
CVE-2026-87969
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...
CVE-2026-86102
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...
CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...
CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI
An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...
CVE-2026-87969
A WatchGuard AP OS command injection vulnerability exists within the diagnostic CLI . An authenticated administrator can execute arbitrary operating system commands by providing crafted input. While the technical root cause is not detailed beyond the input handling flaw, the impact allows for ful...
CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...
EUVD-2026-88364
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...
CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...
CVE-2026-86102
The WatchGuard AP is affected by an OS command injection vulnerability within its internal API service . An attacker with network access to the AP can exploit this flaw to execute arbitrary shell commands on the underlying operating system. The vulnerability is assigned a CRITICAL base severity s...