20914 matches found
CVE-2026-0773 Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0773
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0766 Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability
Open WebUI loadtoolmodulebyid Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0766
Open WebUI contains a vulnerability in load_tool_module_by_id that allows remote code execution via command injection. The flaw comes from insufficient validation of a user-supplied string before it is used to execute Python code, enabling an attacker to run arbitrary code in the service account’...
CVE-2026-0766 Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability
Open WebUI loadtoolmodulebyid Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0755
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0755 gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0755
CVE-2026-0755 affects the gemini-mcp-tool, specifically the execAsync method. The flaw is an OS command injection (CWE-78) caused by insufficient validation of user-supplied input before it is used in a system call, enabling unauthenticated remote code execution. Attackers could run arbitrary cod...
CVE-2026-0755 gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...
SUSE CVE-2026-24049
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the...
Northwest Performance Managed Switch Port Mapping Tool security vulnerabilities
Northwest Performance Managed Switch Port Mapping Tool is a network discovery and management software developed by the American company Northwest Performance. Version 2.85.2 of Northwest Performance Managed Switch Port Mapping Tool contains a security vulnerability. This vulnerability stems from...
WordPress plugin PopCash.Net Code Integration Tool has a security vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
Google Gemini MCP Tool operating system command injection vulnerability
Google Gemini MCP Tool is a tool component developed by Google Inc., based on large model context protocols. Google Gemini MCP Tool has a vulnerability related to operating system command injection. This vulnerability stems from the execAsync method, which executes system calls without verifying...
Open WebUI Code Injection Vulnerability
Open WebUI is an open-source, scalable, feature-rich, and user-friendly self-hosted WebUI. Open WebUI has a code injection vulnerability, which stems from the lack of validation for the string provided by users in the loadtoolmodulebyid function. This vulnerability may lead to code injection and...
FreeBSD : wheel -- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (65439aa0-f77d-11f0-9821-b0416f0c4c67)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 65439aa0-f77d-11f0-9821-b0416f0c4c67 advisory. https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx reports: wheel is a command line...
PT-2026-4510
Name of the Vulnerable Software and Affected Versions Managed Switch Port Mapping Tool version 2.85.2 Description The software contains a denial of service issue that allows attackers to crash the application. This is achieved by creating an oversized buffer. Specifically, attackers can generate ...
PT-2026-4450
Name of the Vulnerable Software and Affected Versions PopCash versions prior to 1.9 Description The PopCash Code Integration Tool has a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. The tool is susceptible to missing authorization...
Orval command injection vulnerability
Orval is an open-source interface development tool developed by Orval. Versions of Orval 7.19.0 and earlier, as well as versions 8.0.0-rc.0 to 8.0.2, have a command injection vulnerability. This vulnerability stems from untrusted OpenAPI specifications that allow arbitrary TypeScript/JavaScript...
Upsonic code issue vulnerabilities
Upsonic is an open-source AI proxy framework developed by Upsonic. Upsonic has code vulnerabilities, which stem from the lack of validation for data provided by users at the addtool endpoint. This vulnerability may lead to the deserialization of untrusted data and remote code execution...