EUVD-2026-54247

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

Progress LoadMaster Command Injection Vulnerability

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

CVE-2026-67434

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

Malicious code in elephant-tusk-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ddbdcdca1756bee69586881547c9e63f555685a2e5e3daa68a9519987edd37a server.js starts an Express + WebSocket server via app.listenPORT,... with no host argument, defaulting the bind to 0.0.0.0, with fully open CORS...

CVE-2026-64654

GitHub CLI (gh) prior to v2.97.0 is affected by a terminal escape sequence injection across multiple gh commands due to lack of neutralization for externally supplied content (gist, API, PRs, releases, codespace, etc.). An attacker who can influence that content can embed escape sequences that ar...

CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the aprdbdoracle provider. An attacker can execute arbitrary SQL commands by injecting specially crafted input. Remediation Upgrade apr-util to version 1.6.5 or higher. References - Apache Mailing List...

CVE-2026-63725

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

MAL-2026-13437 Malicious code in aitable-workflow-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host...

CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

Malicious code in @addai/node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca685518d56ea513609a2dfcd845bb14d94c3faaf58645553c688ca59817921 The package installs a background daemon dist/session-runner.js that pairs the host to a remote +Ai account and polls a hardcoded Supabase backend at...

Malicious code in @addai/ainode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261 After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at...

MAL-2026-13409 Malicious code in @addai/ainode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261 After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at...

MAL-2026-13408 Malicious code in @activepieces/piece-base44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183bc897806f97f30cf26098efd5714de47475d007a7d5e23fe8fb05dbfe9df7 src/index.js requires childprocess and issues a ping command at line 16, with multiple POST calls at lines 13, 14, and 29 to hardcoded destinations...

Malicious code in agenttunnels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...

Malicious code in @activepieces/piece-google-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e200ba4f9d11d42636dbbd1fa698843321af8b0bd23ff63493c0ce94891a5cb src/index.js imports childprocess and issues POST requests alongside a ping command invocation lines 25, 38, 49. The co-occurrence of childprocess...

CVE-2026-71311

A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed CRLF characters can be injected...

PT-2026-68669

Name of the Vulnerable Software and Affected Versions chiuwingyan house versions up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670 Description A remote SQL injection exists in the /paid/selectall.action endpoint. This occurs when the zuname argument is manipulated, allowing an attacker to execute...