73428 matches found
CVE-2026-28199: Improper Verification of Cryptographic Signature
An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...
CVE-2026-53557
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
UBUNTU-CVE-2026-53534
JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...
CVE-2026-53534
JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...
CVE-2026-52483
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...
CVE-2026-92993
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...
EUVD-2026-82422
Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through...
Security Bulletin: Vulnerable Version of Software in Use
Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-3783 DESCRIPTION: When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a redirect to a second URL, curl could leak that token to...
Security Bulletin: Vulnerable Version of Software in Use
Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2025-14017 DESCRIPTION: When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl, changing TLS options in one thread would inadvertently change them global...
CVE-2026-47252
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...
EUVD-2026-82379
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...
CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...
CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...
CVE-2026-92993
Dromara mayfly-go (up to 1.11.5 ) is vulnerable to an OS command injection via the RunMachineScript function in server/internal/machine/api/machine_script.go (Machine Script Feature). Remote attackers with the machine:script:run permission and tag access can achieve arbitrary command execution on...
CVE-2026-92980
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...
CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...
CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...
EUVD-2026-81910
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...
CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export
HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...