101 matches found
EUVD-2026-71227
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-85620
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...
CVE-2026-74853
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...
CVE-2026-74853
The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...
PT-2026-85544
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...
EUVD-2026-14385
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise of the device...
MiracleLinux 8 : vim-8.0.1763-15.el8 (AXSA:2020-998:02)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-998:02 advisory. vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 Tenable has extracted the preceding descripti...
Exploit for CVE-2025-68120
Vulnerability Write-up: Command Injection in VS Code Go Extens...
CVE-2023-29201
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped...
SUSE CVE-2025-68120
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
CVE-2025-68120
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
Visual Studio Code Go extension has unexpected untrusted code execution
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
GHSA-FJMR-7667-8V4P Visual Studio Code Go extension has unexpected untrusted code execution
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
EUVD-2025-205668
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
CVE-2025-68120
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection when operating in Restricted Mode, which is enabled for untrusted workspaces. Remediation Upgrade github.com/golang/vscode-go/extension to version 0.52.0-rc.1 or higher. References - GitHub ChangeLog - GitHub...
Google Go 安全漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. A security vulnerability exists in Google Go that stems from the possibility of triggering untrusted code execution in restricted mode...
