192600 matches found
CVE-2026-116676
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-102814
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...
CVE-2026-102815
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...
CVE-2026-102815 Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...
CVE-2026-102815
A local command injection vulnerability exists in the tmpServer service of the TP-Link RE305 V3 . The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process can submit a crafted request to the TDDPv1 service to execu...
EUVD-2026-111274
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...
EUVD-2026-111273
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...
CVE-2026-102814
The TP-Link RE305 V3 is vulnerable to an authentication weakness in the TDDP v2 service . The service utilizes a fixed and derivable cryptographic key, which allows an unauthenticated attacker on the same local network to forge protocol packets. By accessing privileged TDDP operations, an attacke...
CVE-2026-102814 Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...
SUSE CVE-2026-115586
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...
CVE-2026-104353
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-116676
The Atlantis self-hosted Go application (versions 0.4.0 through 0.47.1) is vulnerable to OS command injection . The flaw exists because the application passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments, which are joined using strings.Join(args,...
CVE-2026-116676
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...
EUVD-2026-111230
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
CVE-2026-104353 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...
CVE-2026-104353
Adobe Campaign Classic (ACC) is impacted by an OS Command Injection vulnerability (CWE-78) caused by the improper neutralization of special elements used in OS commands. This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user ...
purpleteam
purpleteam CLI CLI component of purpleteam - Currently in alpha Installation Simplest npm install -g purpleteam If you want to debug Clone this repository. Configuration Copy the config/config.example.json to either config/config.local.json or config/config.cloud.json depending on which...
CVE-2026-117511
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...