Lucene search
+L

32384 matches found

Positive Technologies
Positive Technologies
added 2026/06/12 12:0 a.m.32 views

PT-2026-48956

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits...

5.1CVSS5.3AI score0.00171EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/06/12 12:0 a.m.13 views

Fedora 43 : composer (2026-4308b5fc39)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4308b5fc39 advisory. Version 2.10.1 - 2026-06-04 Security: Fixed shell escaping when opening an editor 12903 Security: Verify backup phar signature before restoring it when using...

5.9AI score
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/11 10:49 p.m.17 views

CVE-2026-42846 ClipBucket: Remote Play URL Command Injection

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly...

9.8CVSS5.5AI score0.00603EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/11 10:49 p.m.88 views

EUVD-2026-36367

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly...

9.8CVSS5.7AI score0.00603EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/11 10:16 p.m.17 views

CVE-2026-45172

Due to incomplete input validation in Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18...

8.8CVSS0.0055EPSS
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/11 9:57 p.m.16 views

Malicious code in internallib_v557 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 275af9596caf2b68994ca8282da7e127f8a4478e07888dbae73826328b4e41f2 index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command, it: 1 creates a Verdaccio user...

5.4AI score
SaveExploits0References25
OSV
OSV
added 2026/06/11 9:57 p.m.14 views

MAL-2026-5678 Malicious code in internallib_v557 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 275af9596caf2b68994ca8282da7e127f8a4478e07888dbae73826328b4e41f2 index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command, it: 1 creates a Verdaccio user...

5.5AI score
SaveExploits0References25
CVE
CVE
added 2026/06/11 9:41 p.m.44 views

CVE-2026-45172

The CVE describes an input validation flaw in Idira Privileged Session Manager for SSH (PSMP). A authenticated, low-privilege user could potentially execute arbitrary commands on the PSMP host due to incomplete input validation in PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6. Affecte...

8.8CVSS5.9AI score0.0055EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/06/11 9:41 p.m.12 views

CVE-2026-45172 Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command

Due to incomplete input validation in Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18...

8.7CVSS5.7AI score0.0055EPSS
SaveExploits0References4
NVD
NVD
added 2026/06/11 9:16 p.m.15 views

CVE-2026-53806

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell content without intended allowlist validation, potentially enabling...

8.8CVSS0.00419EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 9:13 p.m.11 views

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the exec process. An attacker can execute unauthorized commands by bypassing intended allowlist validation using combined shell options...

8.8CVSS6AI score0.00419EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/11 8:5 p.m.38 views

CVE-2026-53806 OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell content without intended allowlist validation, potentially enabling...

8.8CVSS0.00419EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/11 8:5 p.m.8 views

CVE-2026-53806 OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell content without intended allowlist validation, potentially enabling...

8.8CVSS5.7AI score0.00419EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/11 8:5 p.m.8 views

CVE-2026-53806 OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation

OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell content without intended allowlist validation, potentially enabling...

7.7CVSS6.2AI score
SaveExploits0References5
CVE
CVE
added 2026/06/11 8:5 p.m.28 views

CVE-2026-53806

OpenClaw vulnerability CVE-2026-53806 affects OpenClaw prior to version 2026.5.12. A shell option parsing flaw allows combined POSIX shell flags to bypass exec revalidation checks, enabling execution of inline shell content without the intended allowlist validation when the affected feature is en...

8.8CVSS5.8AI score0.00419EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/06/11 6:32 p.m.87 views

CVE-2026-47162

Vim (with the netrw plugin) is affected by CVE-2026-47162 due to a Vimscript code injection in s:NetrwBookHistSave() when serializing directory paths to the history file ~/.vim/.netrwhist. A directory name from the filesystem can be interpolated into a single-quoted Vimscript string literal witho...

8.8CVSS5.9AI score0.00219EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/06/11 6:32 p.m.11 views

CVE-2026-47162 Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave in the netrw plugin runtime/pack/dist/opt/netrw/autoload/netrw.vim when serializing browsed directory paths to the history file /.vim/.netrwhist. A...

7.3CVSS6.2AI score
SaveExploits0References8
CVE
CVE
added 2026/06/11 6:31 p.m.94 views

CVE-2026-47167

Vim has a code injection vulnerability in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) affecting builds with +ruby support prior to version 9.2.0496. A crafted step-definition regex pulled from .rb files under features// or stories/ / directories is embedded into a Ruby Kernel.eva...

5.3CVSS5.9AI score0.00135EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 2026/06/11 6:31 p.m.12 views

EUVD-2026-36280

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch in the cucumber filetype plugin runtime/ftplugin/cucumber.vim on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's...

5.1CVSS5.9AI score0.00135EPSS
SaveExploits0References3
NVD
NVD
added 2026/06/11 6:16 p.m.35 views

CVE-2026-49261

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

10CVSS0.01582EPSS
SaveExploits0References13
Rows per page
Query Builder