229157 matches found
CVE-2026-19326
A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...
CVE-2026-19327
CVE-2026-19327 affects the package abracadabra50 claude-sesh 1.0.0. The flaw is in the function getEnrichedData/enrichSession within src/services/enricher.ts, where manipulating the argument sessionId can trigger path traversal. The issue is operable locally, with CVSS-based assessments indicatin...
EUVD-2026-54858
A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...
CVE-2026-71993 MSI Radix AXE6600 v781521 Command Injection via openvpn function
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root...
PT-2026-69289
Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A remote SQL injection exists due to improper processing of the /viewdoctor.php endpoint. An attacker can exploit this by manipulating the delid variable to execute unauthorized...
EUVD-2026-54806
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...
CVE-2026-71948 D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...
Exploit for CVE-2026-64638
CVE-2026-64638 Reflected XSS on Login Screen Leading to PH...
CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
exploit-development-framework
Exploit Development Framework EDF A modular, educational ex...
CVE-2026-19268
A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the component Claude Usage Range Endpoint. The manipulation of the argument since leads to command...
CVE-2026-19268
Summary of CVE-2026-19268 (abdullah1854 MCPGateway) : The vulnerability affects the MCPGateway project up to commit 549f494a9e363f40530149de324b8097de424230, specifically the Claude Usage Range Endpoint. The issue is in the function getUsageByDateRange within src/services/claude-usage.ts, where a...
CVE-2026-19268 abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection
A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the component Claude Usage Range Endpoint. The manipulation of the argument since leads to command...
CVE-2026-19259
A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability CVSS score: 10.0, which does not carry a CVE identifier, allows an unauthenticated remote attacker ...
CVE-2026-19263
INQUIRELAB mcp-bridge-api (up to b30a82aa1d1d1139e0de846c41c8aadee6e06114), specifically the Servers Endpoint component mcp-bridge.js, is affected by a command injection vulnerability triggered by manipulating the command/args argument. The issue allows remote initiation. The product uses a rolli...