28049 matches found
CVE-2026-30307
The Roo Code AI-based autonomous coding agent contains a critical OS command injection vulnerability within its command auto-approval module . The root cause is the use of fragile regular expressions to parse command structures, which fails to account for standard Shell command substitution (e.g....
Apple Security Advisory 03-24-2026-2
Apple Security Advisory 03-24-2026-2 - iOS 18.7.7 and iPadOS 18.7.7 addresses bypass, null pointer, out of bounds access, and use-after-free vulnerabilities...
consult-llm-mcp 操作系统命令注入漏洞
consult-llm-mcp is a multi-model code consultation server developed by Raine Virta. Versions of consult-llm-mcp prior to 2.5.3 had an operating system command injection vulnerability. This vulnerability stemmed from incorrect operations with parameters gitdiff.baseref/gitdiff.files in the...
Cline 安全漏洞
Cline is an AI programming assistant that serves as an integrated CLI and editor for necboy developers. Cline has a security vulnerability, which stems from a vulnerability in the command autentication module—specifically, an OS command injection vulnerability—potentially allowing remote code...
PT-2026-29100
Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, i...
Panthor driver Heap Buffer Overflow DoS
The vulnerability of the panthorschedunplug function in the drivers/gpu/drm/panthor/panthorsched.c file of the Panthor driver which provides DRM support for ARM Mali CSF-based graphics processors in the Linux operating system is related to the use of memory after deallocation. Exploiting this...
Linux Samsung Exynos visconti_register_pll Heap Buffer Overflow DoS
The vulnerability of the viscontiregisterpll function in the drivers/clk/visconti/pll.c file of the Samsung Exynos Linux operating system’s clock controller driver is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
Cisco IOS IKEv2 DoS
The vulnerability of the Internet Key Exchange Version 2 IKEv2 function in Cisco IOS operating systems, as well as in the Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD devices, is related to a memory leak error during the processing of incoming IKEv2 packets...
Codebase MCP 操作系统命令注入漏洞
Codebase MCP is a code library retrieval and analysis tool developed by DeDeveloper23. Codebase MCP has a vulnerability related to operating system command injection. This vulnerability stems from a function in the Component RepoMix Command Handler called getCodebase/getRemoteCodebase/saveCodebas...
CVE-2026-5012 elecV2 elecV2P rpc pm2run os command injection
A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem ear...
CVE-2016-20044
Removed by vendor...
TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign
Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices. The activity has been attributed with high confidence to the Russian state-sponsored threat group known as...
mcp-docs-rag MCP Server 操作系统命令注入漏洞
The mcp-docs-rag MCP Server is a RAG Q&A server developed by Kazuhiro Homma, based on local documentation. Versions of the mcp-docs-rag MCP Server prior to 0.5.0 contained an operating system command injection vulnerability. This vulnerability stems from the cloneRepository function in the...
Critical Photon OS Security Update - PHSA-2026-5.0-91-0801
Updates of 'mozjs', 'nss' packages of Photon OS have been released...
NewStart CGSL MAIN 7.02 : webkitgtk Vulnerability (NS-SA-2026-0037)
The remote NewStart CGSL host, running version MAIN 7.02, has webkitgtk packages installed that are affected by a vulnerability: - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2,...
Photon OS 5.0: Mozjs PHSA-2026-5.0-0801
An update of the mozjs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0801. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
websec-payloads
Web Security Payloads & Exploitation Reference Comprehensiv...
Vulnerabilities fixed in F5 Networks BIG-IP, F5OS and NGINX App Protect WAF
F5 Networks has fixed vulnerabilities in the BIG-IP and F5OS product lines and NGINX App Protect WAF. The vulnerabilities include several configuration issues and exploit vectors. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of...
EUVD-2026-16600
The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...