CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

CVE-2026-18733

CVE-2026-18733 affects the Shell tool in Amazon Strands Agents Tools prior to v0.8.0. A crafted prompt can set non_interactive to true, bypassing the consent gate and potentially allowing remote execution of arbitrary OS commands on the agent host. Impact appears to involve remote command executi...

MAL-2026-11502 Malicious code in simple-date-formatter-new-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 628527c388185356d23a8905edf240a32c062afb06c00a58c0101ffd4bcc5182 On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device via mknod, enumerates...

Malicious code in simple-date-formatter-new-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 628527c388185356d23a8905edf240a32c062afb06c00a58c0101ffd4bcc5182 On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device via mknod, enumerates...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-67609 Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in...

CVE-2026-67608 Telenia TVox 26.5.3 OS Command Injection via action_audio.php

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in actionaudio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec call...

CVE-2026-67608

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in actionaudio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec call...

Moodle - Remote Code Execution

Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system. id: CVE-2024-43425 info: name: Moodle - Remote Code Execution author:...

Zabbix - SQL Injection

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...

CVE-2026-67975

CVE-2026-67975 concerns NASA cFS v7.0.1. The issue is an improper access-control flaw in the subscription/stream management mechanism, allowing an attacker to arbitrarily remove low-index subscriptions and add new streams by issuing TO_LAB add/remove subscription commands over the network. The CV...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

PT-2026-67387

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

CVE-2026-67975

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

UBUNTU-CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67325

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...

EUVD-2026-51858

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...