CVE-2026-45035: Improper Neutralization of Special Elements used in an OS Command

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...

Exploit for Missing Authentication for Critical Function in Flowiseai Flowise

Silentium — HackTheBox Writeup Platform: HackTheBox...

WS-2020-0442

In curling in versions 0.1.0 to 1.1.0 is vulnerable to RCE , can bypass the security check for special characters, read / overwrite file...

WS-2020-0440

In imagickal in versions 0.1.0 to 5.0.0 is vulnerable to RCE, it allows to execute arbitrary commands on the victim's PC...

WS-2020-0436

In commit-msg in versions 0.1.0 to 0.2.3 is vulnerable to RCE, via insecure command formatting...

WS-2020-0439

In arpping in versions 1.0.0 to 2.0.0 is vulnerable to RCE, it allows to execute arbitrary commands on the victim's PC...

WS-2020-0438

In i18next in versions v19.6.0 to v19.8.2 is vulnerable to prototype pollution, it allows to modify the prototype of a base object, which may result in DoS, XSS, RCE, etc...

WS-2020-0435

In windows-edge in versions 1.0.0 and 1.0.1 is vulnerable to RCE, It allows to execute arbitrary commands remotely inside the victim's PC...

CVE-2026-41315

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modifycrond and /starttask interfaces, it is possible to modify the default built-in scheduled tasks and start...

CVE-2026-44670 SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...

CVE-2026-42589 Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded i...

WS-2020-0217

A Remote Command Execution RCE vulnerability was found in bunyan before 1.8.13 and 2.x before 2.0.3. The issue occurs because a user input is formatted inside a command that will be executed without any check...

WS-2020-0086

localeval through 15.2.3 is vulnerable to Sandbox Escape leading to Remote Code Execution...

WS-2020-0075

@zhaoyao91/eval-in-vm through 0.0.0 ia vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor . This may allow attackers to execute arbitrary code in the system. Evaluating the payload...

WS-2020-0073

sandbox through 0.8.6 is vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor. This may allow attackers to execute arbitrary code in the system. Evaluating the payload...

CVE-2026-41315: Improper Neutralization of Special Elements used in an OS Command

mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthorized remote command execution vulnerability. Due to the lack of authentication on the /modifycrond and /starttask interfaces, it is possible to modify the default built-in scheduled tasks and start...

CVE-2026-8500

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection...

CVE-2026-45708

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...

CVE-2026-45714

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

CVE-2026-8500: Improper Neutralization of Special Elements used in an OS Command

Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection...