CVE-2019-11223

CVE-2019-11223 Arbitrary File Upload in Wordpress Plugin SupportCandy Version 2.0 Below https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/ https://wordpress.org/plugins/supportcandy/developers...

CVE-2026-108953

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

Malware in @library-wide/library-shell

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-108953

The software mac-shell-mcp before version 2.0.0 is vulnerable to an OS command injection (CWE-78) within the execute_command arguments. This flaw allows MCP clients to bypass the command whitelist by injecting shell metacharacters (e.g., ;) into arguments of safe commands like pwd. Successful exp...

CVE-2026-108953 mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

CVE-2026-108953 mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

EUVD-2026-97360

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

CVE-2026-108953

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

CVE-2026-108953 mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...

MSC-2026-12732

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive user system data –...

MSC-2026-12729

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive user system data –...

MSC-2026-12733

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive user system data –...

Important: Red Hat Security Advisory: emacs security update

An update for emacs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

emacs: emacs: Command injection via crafted filenames in TRAMP

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...

kippo

NOTA: Para desarrollos más recientes, consulte el fork de Michel Oosterhof Kippo Kippo es un honeypot SSH de interacción media diseñado para registrar ataques de fuerza bruta y, lo más importante, toda la interacción de shell realizada por el atacante. Kippo está inspirado, pero no basado, en...

PT-2026-110512

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be...

PT-2026-110867

Attackers exploited CVE-2024-85097, a critical CVSS 10.0 WordPress vulnerability, using GIF/PHP polyglot files to achieve unauthenticated remote code execution. Campaign involved 63 unique IP addresses targeting Bricksforge plugin installations for web shell deployment. ZeroDay WordPressSecurity ...

PT-2026-110915

Name of the Vulnerable Software and Affected Versions easy-pdf-merge versions 0.1.0 through 0.2.6 Description An OS command injection flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the source paths, destination path, or the maxHeap option. This occurs...

ALSA-2026:80664 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

CVE-2025-71429: Improper Neutralization of Special Elements used in an OS Command

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $... in the UVR5 WebUI output folder textboxes with mp3 or m4a export...