EUVD-2026-78367

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-47424

OpenAM (Open Access Management) Community Edition through 16.0.6 contains a Protection Mechanism Failure (CWE-693) in the GroovySandboxValueFilter component of its server-side scripting sandbox. An authenticated user with the ability to create or edit scripts in an executed context — such as a su...

CVE-2026-19515

CVE-2026-19515 is an OS command injection vulnerability in the WSO2 Integrator MI VS Code extension . The extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources , allowing a crafted project to inject and execute...

PT-2026-92120

Name of the Vulnerable Software and Affected Versions Yonyou U8 CRM affected versions not specified Description An unauthenticated SQL injection exists in the 'fillbacksettingedit.php' endpoint. By using the DontCheckLogin=1 parameter, authentication is bypassed, and the id parameter is...

PT-2026-91921

Name of the Vulnerable Software and Affected Versions WSO2 Integrator MI VS Code extension affected versions not specified Description The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untruste...

CVE-2026-47424: Protection Mechanism Failure

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-53710: Improper Control of Generation of Code

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the pythonsandboxserver in mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py exposes raw getattr through safebuiltins, omits a required getattr guard, and relie...

PT-2026-91901

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

VulnCheck KEV: CVE-2024-58385

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...

CVE-2026-16673 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...

EUVD-2026-77531

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...

CVE-2026-82795

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82796

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82796

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-77252

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82796

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82795

SolarView Compact (Contec) contains a cross-site scripting (XSS) vulnerability in its Schedule Settings and Mail Send Setting features. If exploited, the XSS can be leveraged to execute an arbitrary OS command by an attacker who has valid credentials to log into the product. The CVSS v3.1 score i...

CVE-2026-82795

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-77251

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-14277: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...