177495 matches found
CVE-2026-18482 CVE-2026-18482
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...
CVE-2026-18482
Neo.mjs is affected by a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server. The issue stems from the checkSyntax() and runPlaywrightTest() functions unsafely interpolating caller-controlled absolutePath values into shell command...
CVE-2026-18482 CVE-2026-18482
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...
CVE-2026-18482 CVE-2026-18482
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
EUVD-2026-63266
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...
CVE-2026-53783
A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...
OESA-2026-3474 dracut security update
dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...
OESA-2026-3473 dracut security update
dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...
OESA-2026-3472 dracut security update
dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well ...
CVE-2025-14601
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...
EUVD-2025-210747
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...
CVE-2025-14601
vsDesk task scheduler passes unsanitized input to OS commands; an authenticated admin can inject arbitrary commands (CVSS 8.6 High). Patch available in versions 14.0101 and later from vendor https://vsdesk.ru/. No in-the-wild exploitation reported. Advisory: https://github.com/klsecservices/Advis...
CVE-2025-14601 vsDesk Task Scheduler OS Command Injection
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...
CVE-2026-76254
creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:10+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
Malicious code in @httttt/mcp-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ee4beb2634f91de84901fbeb18674445c67c33a45c93a6509f72e03fe1a01b6 The package registers an MCP tool named execcommand that accepts a command string argument from the connected MCP client and passes it directly to...
GO-2026-6185 vulnerabilities
Vulnerabilities for packages: telegraf...
