Sakura Editor vulnerable to OS command injection

Overview Sakura Editor provided by Sakura Editor Development Community has a functionality "Open Terminal". It does not neutralize the string which represents the current directory the directory where the editing file is located. OS command injection CWE-78 - CVE-2026-59561 Impact If a victim use...

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

EUVD-2026-64730

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-59561

Sakura Editor , a text editor developed by the Sakura Editor Development Community, is affected by an OS command injection vulnerability. When a user is directed to edit a file located in a crafted directory and subsequently invokes the "Open Terminal" feature, an attacker may achieve arbitrary O...

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-59561

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

EUVD-2026-64670

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

EUVD-2026-64673

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-78154

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SD...

PT-2026-79825

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-59561: Improper Neutralization of Special Elements used in an OS Command

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...

CVE-2026-78154 the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-78154

...

CVE-2026-78154

...

CVE-2026-78154

CVE-2026-78154 was withdrawn by its CNA after further investigation showed it was not a security issue . The original finding described missing authentication in the Public Invitation-Code Redemption Endpoint (function redeem_invitation_code in backend/app/api/routes/v1/user_invitation_code.py) o...

CVE-2026-78145

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145

CTFd versions up to 3.8.4 are affected by an open redirect vulnerability in the _is_safe_url function within CTFd/utils/validators/__init__.py. A remote attacker with no privileges can manipulate the Next argument to redirect users to an arbitrary URL, requiring only user interaction. The CVSS 3....

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...