CVE-2026-104353 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...

CVE-2026-117511

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-117511 desmondmorris node-tesseract Command Builder tesseract.js process os command injection

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

EUVD-2026-111143

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-117511 desmondmorris node-tesseract Command Builder tesseract.js process os command injection

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-117511

A vulnerability exists in desmondmorris node-tesseract up to version 0.2.7 within the Command Builder component. Specifically, the process function in the lib/tesseract.js file is susceptible to OS command injection because the image argument is not properly neutralized. This flaw allows for remo...

CVE-2026-117511

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-117511 desmondmorris node-tesseract Command Builder tesseract.js process os command injection

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-90464

The WatchGuard Fireware OS firewall contains an external control of file path vulnerability within a diagnostic command. A remote, authenticated attacker possessing at least read-only (Device Monitor) privileges and management CLI access can submit a specially crafted command to create, truncate,...

CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...

GHSA-F9J4-QGGQ-H239 GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

Summary Remote.pull in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec for example a user-supplied branch or refspec paramete...

GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

Summary Remote.pull in GitPython forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec for example a user-supplied branch or refspec paramete...

Exploit for CVE-2026-16723

CVE-2026-16723 fastjson 1.2.83 Remote Code Execution Replay En...

OPENSUSE-SU-2026:22195-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: + Fix IMAP command injection via CRLF in uid parameter of...

python-setuptools: Fix of 2 CVEs

CVE-2022-40897: ReDoS in packageindex REL regex - CVE-2024-6345: command injection via svn URLs in packageindex...

CVE-2026-94346

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high...

CVE-2026-117567

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port,...

CVE-2026-117568

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $, backticks or a closing double quote in an...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117569

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in executetool in kaligpt/tools/mcpserver.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target,...