bootleg (1.1.0), cyberbrain (0.2.3) +6 more potentially affected by CVE-2026-44660 via ujson (4.1.0)

ujson PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - bootleg 1.1.0 - cyberbrain 0.2.3 - dataplate =0.2.0, =4.2.0, =0.7.0, =0.3.3, =0.2.0, =0.2.1 Source cves: CVE-2026-44660 Source advisory:...

CVE-2026-6942

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...

CVE-2026-6942

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...

CVE-2026-6942 radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...

CVE-2026-6942

Radare2-MCP

CVE-2026-6942: Improper Neutralization of Special Elements used in an OS Command

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...

PT-2026-34753

Name of the Vulnerable Software and Affected Versions radare2-mcp versions 1.6.0 and earlier Description An OS command injection flaw allows remote, unauthenticated attackers to execute arbitrary commands on the host system. This is achieved by bypassing the command filter using shell...

CVE-2026-26367

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user UGUSER to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce...

EUVD-2026-6140

eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user UGUSER can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their...

CVE-2026-26368

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user UGUSER to reset the password of arbitrary accounts, including those in the UGADMIN and UGSUPERADMIN groups, without...

CVE-2026-26367

Affected product : eNet SMART HOME server versions 2.2.1 and 2.3.1. Vulnerability : missing authorization in the deleteUserAccount JSON-RPC method, allowing any authenticated low-privilege user (UG_USER) to delete arbitrary user accounts (excluding built-in admin). Impact : potential for unauthor...

CVE-2021-22019

The vCenter Server contains a denial-of-service vulnerability in VAPI vCenter API service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition...

com.consol.citrus:citrus-websocket (>=2.6.1, <=2.6.2), org.kurento:kurento-jsonrpc-server (6.6.0) +5 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.7.release)

org.springframework:spring-websocket MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.6.1, =1.3.6.release, =4.2.9.release,...

EUVD-2012-5761

Malware in sbrugna...

EUVD-2018-1785

Malware in sbrugna...

EUVD-2021-9188

Malicious code in bioql PyPI...

EUVD-2022-39486

Malicious code in bioql PyPI...

CVE-2025-27236 User information disclosure via api_jsonrpc.php on method user.get with param search

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...

CVE-2023-43118

Cross Site Request Forgery CSRF vulnerability in Chalet application in Extreme Networks Switch Engine EXOS before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API...

balto (>=0.1.5, <=0.3.0), botx (0.12.0) +4 more potentially affected by CVE-2024-3772 via pydantic (0.30.0)

pydantic PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - balto =0.1.5, =0.1.2, =0.33.0, =0.1.7, =0.1.23 Source cves: CVE-2024-3772 Source advisory: OSV:GHSA-MR82-8J83-VXMV...