CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

EUVD-2026-53932

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975

OpenChamber 1.11.7 is affected by an unauthenticated RCE via POST /api/fs/exec. The endpoint passes commands verbatim to Node.js spawn() without any allowlist or argument validation, enabling remote execution of arbitrary OS commands. The authentication middleware becomes a no-op when UI_PASSWORD...

CVE-2026-66373

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

Important: Red Hat Security Advisory: gpsd security update

An update for gpsd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution

A flaw was found in gpsd, a service application that monitors one or more GPSes or AIS receivers. The gpsprof utility is vulnerable to a command injection. An attacker who can control the GPS device subtype value can embed malicious commands within the gnuplot plot title. When a user processes a...

MAL-2026-13418 Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

EUVD-2026-53930

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client (VSI) before version 10.11.1.0 contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could execute arbitrary OS commands on the VSI host with root privileges, potentially leading to full sy...

MAL-2026-13414 Malicious code in @atom8n/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...

Malicious code in @atom8n/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...

Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

MAL-2026-13413 Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

CVE-2026-5134 SQLi in Loca Software's CMS

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...

CVE-2026-5134

CVE-2026-5134 describes an SQL injection in Loca Software Informatics Technology Ltd. Co. CMS. Affected as of CMS version up to 06082026. The issue is due to improper neutralization of special elements used in SQL commands (SQLi) and is classified with CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...