PT-2026-41314

Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and...

PT-2026-41270

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host...

GHSA-FM77-94QM-4894 Crabbox: environment variable exposure vulnerability

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit...

CVE-2026-45227

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted...

EUVD-2026-30418

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit...

CVE-2026-8634 Crabbox < v0.12.0 Environment Variable Information Disclosure

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit...

CVE-2025-68421

Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in...

WS-2019-0471

Versions of rpc-websocket = 0.7.6 contain malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor...

WS-2019-0428

All versions of foever are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands...

WS-2019-0392

Axois is a malicious package designed to take advantage of users making a mistake when typing name of a module to install and eventually can lead to execution of arbitrary commands...

WS-2019-0265

Wizard-syncronizer, in all versions, is vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since th...

WS-2019-0264

Cocos-utils is vulnerable in all version to Remote Code Execution. The unzip function concatenates user input to exec this can lead attackers to execute arbitrary commands on the server...

WS-2019-0262

Tomato, in all versions, is vulnerable to Command Injection. The /api/exec endpoint does not validate user input which allows attackers to run arbitrary commands in the system...

WS-2019-0194

awesomebot 1.18.0 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

nightwatch-commands (>=1.8.0, <=2.0.0) potentially affected by unknown CVE via selenium-download (2.0.6)

selenium-download NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on selenium-download and may be impacted: - nightwatch-commands =1.8.0, =2.0.0 Source cves: unknown CVE Source advisory: MEND:WS-2016-0125...

WS-2019-0131

expressfs does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. this command injection vulnerability exist in all versions...

Cordon multi-purpose photoreceiver family Command Execution

The vulnerability of the Cordon multi-purpose photoreceiver family is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote-operating intruder to execute arbitrary commands...

Vim < 9.2.0435 OS Command Injection (GHSA-hwg5-3cxw-wvvg)

The version of Vim installed on the remote host is prior to 9.2.0435. It is, therefore, affected by a vulnerability as referenced in the GHSA-hwg5-3cxw-wvvg advisory. - Vim's :find command-line completion feature is affected by an OS command injection vulnerability. When the path option contains...

PT-2026-40903

Name of the Vulnerable Software and Affected Versions Comarch ERP Optima versions prior to 2026.4 Description The client uses a hard-coded password for a database user that cannot be changed. This allows a remote attacker to gain access to the database with elevated privileges, which may include...

PT-2026-51507

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2 Description Multiple OS command injection flaws exist in the Custom MCP Server feature. An attacker with any account role or API access with view/update permissions for chatflows can execute arbitrary commands o...