CVE-2026-95660

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95660

A security flaw in Moonshot AI Kimi Code (up to version 0.31.0) allows for OS command injection via an unknown function in the MCP Configuration Loader component, specifically within the agent-core-v2/src/agent/mcp/config-loader.ts file. The vulnerability can be triggered remotely through the man...

CVE-2026-95660 Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95660 Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

EUVD-2026-84628

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95660 Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95660: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

PT-2026-96932

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-76159

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

EUVD-2026-78330

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

CVE-2026-76159

CVE-2026-76159 is an Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 . A local low-privileged attacker can escalate privileges to NT AUTHORITY\SYSTEM by placing an attacker-controlled preload.json file, which the ...

CVE-2026-76159 Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

PT-2026-91899

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITYSYSTEM via an attacker-controlled preload.json file...

CVE-2026-76159: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

CVE-2026-55108

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...

Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f On require, index.js loads adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-.workers.dev...

CVE-2025-48617

A permissions bypass in the overrideConfig function of CarrierConfigLoader.java allows for a UID check bypass within the Android System component. This vulnerability can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. This issue is ad...

PT-2026-52869

Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN-* allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN- exists due to insufficient checks on the integrity of the firmware. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context. P...