EUVD-2021-30938

Malicious code in bioql PyPI...

EUVD-2025-19560

Malicious code in bioql PyPI...

EUVD-2024-37352

Malicious code in bioql PyPI...

EUVD-2023-40566

Malicious code in bioql PyPI...

EUVD-2023-43140

Malicious code in bioql PyPI...

EUVD-2022-52386

Malicious code in bioql PyPI...

EUVD-2021-8057

Malicious code in bioql PyPI...

EUVD-2022-41125

Malicious code in bioql PyPI...

EUVD-2022-44922

Malicious code in bioql PyPI...

EUVD-2022-4690

Malicious code in bioql PyPI...

EUVD-2025-24801

Malicious code in bioql PyPI...

EUVD-2024-25836

Malicious code in bioql PyPI...

Viessmann Vitogate 300

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify an intended OS command when it is sent to a downstream component, or allow an attacker to cause unexpected interactions between the client and server. 2. RECOMMENDED PRACTICES CISA recommends users...

CVE-2025-54084

CVE-2025-54084 refers to an OS Command Injection in Calix GigaCenter ONT (Quantenna SoC modules). The vulnerability arises from improper input validation in the OS command pathway, allowing authenticated attackers with super credentials to execute arbitrary OS commands, potentially leading to ful...

PT-2025-35938

Name of the Vulnerable Software and Affected Versions OpenEdge AdminServer affected versions not specified Description The OpenEdge AdminServer is susceptible to Remote Command Execution RCE via its Java RMI interface. Authenticated users can inject and execute OS commands under the delegated...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2025-8943

Flowise CVE-2025-8943 affects Flowise versions before 3.0.1. The vulnerability resides in the Custom MCPs feature, specifically the /api/v1/node-load-method/customMCP endpoint, where insufficient authentication/authorization allows unauthenticated network attackers to execute OS commands unsandbo...

CVE-2025-55077 Tyler Technologies ERP Pro 9 SaaS application escape

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment...

CVE-2025-43979

An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the xmlaction.cgi?method= endpoint...

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability

D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...