PT-2026-64000

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the file upload functionality within the DataHub module. Authenticated attackers can use a crafted filename to perfo...

CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

CVE-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

CVE-2026-7328

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

EUVD-2026-47746

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328

CVE-2026-7328 concerns Caliptra Core Runtime Firmware (2.1.0) and reports missing authorization in subsystem mode for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands. This allows a privileged local attacker to trigger a denial-of-service via mailbox commands that con...

CVE-2026-62144

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

CVE-2026-62144 Management Authentication Bypass and Privilege Escalation

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

Malicious code in react-tabulix-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...

Command Injection

Overview @n8n/computer-use is a Local AI gateway for n8n AI Assistant — filesystem, shell, screenshots, mouse/keyboard, and browser automation Affected versions of this package are vulnerable to Command Injection via the Shell tool activation path in...

PT-2026-63551

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's STOMP encoder StompSubframeEncoder fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder...

SUSE CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-8985 Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-44879 Authenticated Command Injection allows arbitrary command execution in CLI Interface

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-44879

CVE-2026-44879 affects HPE Aruba EdgeConnect SD-WAN ECOS gateways with an authenticated, highly privileged attacker able to perform command injection via the CLI. Reported impact is arbitrary command execution on the underlying OS. Affected ECOS versions include 9.4.x.x (≤9.4.6.x), 9.5.x.x (≤9.5....