CVE-2026-79920

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

OS Command Injection

strapi is vulnerable to OS Command Injection. The vulnerability exists as it does not sanitize nor validate plugin names in installPlugin and uninstallPlugin...