CVE-2026-116103

A code injection vulnerability exists in Sony Neural Network Libraries up to version 1.39.0 . The flaw is located in the load_param_in_txt function within the file python/src/nnabla/utils/cli/encode_decode_param.py, specifically affecting the Encode Param Command Handler component. This vulnerabi...

CVE-2026-116102

The QuantGeekDev docker-mcp software (versions 0.1.0/0.2.0 ) is vulnerable to an os command injection flaw. The vulnerability exists in the _build_windows_command function within the docker_executor.py file. Improper handling of the project_name argument allows an attacker to inject operating sys...

EUVD-2026-109587

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function buildwindowscommand of the file dockerexecutor.py. This manipulation of the argument projectname causes os command injection. It is possible to initiate the attack remotely...

CVE-2026-116102 QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function buildwindowscommand of the file dockerexecutor.py. This manipulation of the argument projectname causes os command injection. It is possible to initiate the attack remotely...

CVE-2026-116102 QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function buildwindowscommand of the file dockerexecutor.py. This manipulation of the argument projectname causes os command injection. It is possible to initiate the attack remotely...

PT-2026-125381

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This affects the function setCloudUpgradeFW of the file lib/cste modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely...

Pillow 12.3.0 Argument Injection

Pillow versions 2.6.0 through 12.3.0 contain an argument injection vulnerability in Ghostscript EPS handling that may allow arbitrary command execution when attacker-controlled filenames are processed. https://packetstorm.news/download/237664...

TOTOLINK A950RG input validation error vulnerability

The TOTOLINK A950RG version 4.1.2cu.5268B20221104 contains a security vulnerability. This vulnerability stems from improper handling of the FileName parameter by the setCloudUpgradeFW function within the file lib/cstemodules/upgrade.so in the Cloud Upgrade component, potentially enabling remote...

TOTOLINK A950RG input validation error vulnerability

The TOTOLINK A950RG running version 4.1.2cu.5268B20221104 contains a security vulnerability. This vulnerability stems from improper handling of the MAC address parameter in the getDeviceInfo function within the file /var/lib/misc/udhcpd.leases in the device-information Handler component,...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1792771843)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792771843 advisory. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed b...

PT-2026-123155

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

PT-2026-123148

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load param in txt of the file python/src/nnabla/utils/cli/encode decode param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to laun...

EUVD-2026-109963

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

CVE-2026-36698

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without...

Mirth Connect 4.4.0 Remote Command Execution

NextGen Healthcare Mirth Connect versions before version 4.4.1 contain an unauthenticated remote code execution vulnerability. This proof of concept submits a crafted XML deserialization payload to execute a command on an affected target. https://packetstorm.news/download/237649...

Continue command injection vulnerability

Version 2.0.0 contains a command injection vulnerability. This vulnerability stems from improper handling of the file core/config/ConfigHandler.ts by the MCPManagerSingleton.setConnections function within the MCP Server Transport component, potentially leading to OS command injection...

PT-2026-125382

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched...

CVE-2025-13833: Improper Certificate Validation

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...

Alex Andru docker-mcp command injection vulnerability

Versions 0.1.0 and 0.2.0 of Alex Andru’s docker-mcp contain a command injection vulnerability. This vulnerability stems from improper handling of the projectname parameter in the buildwindowscommand function within the dockerexecutor.py file, potentially allowing remote execution of OS commands v...

PT-2026-123165

A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public a...