Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox al...

CVE-2026-85523

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Inf

历史摘要 · 未重新核验 · NVD

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted fil...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows re

历史摘要 · 未重新核验 · NVD

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_ser...

CVE-2026-105788

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the

历史摘要 · 未重新核验 · NVD

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component...

CVE-2026-105487

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_di

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the ...

CVE-2026-105484

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio

历史摘要 · 未重新核验 · NVD

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

CVE-2026-102829

# Security control bypass in `@simple-git/argv-parser`: Git's `VISUAL` editor fallback is not classified as `allowUnsafe

历史摘要 · 未重新核验 · GitHub Advisory

simple-git unsafe-operation guard does not block trailer command configuration

CVE-2026-102828

## Affected product The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted val

历史摘要 · 未重新核验 · GitHub Advisory

simple-git allows command execution through unblocked Git configuration includes

CVE-2026-102826

## Summary An OS command injection vulnerability in `git.clone()` allows any application that flows attacker-influenced

历史摘要 · 未重新核验 · GitHub Advisory

@nx/docker: OS command injection in the @nx/docker release pipeline

CVE-2026-104859

## Summary The `@nx/docker` release pipeline builds its `docker` invocations as shell command strings, interpolating `r

历史摘要 · 未重新核验 · GitHub Advisory

Nx: OS command injection via git revisions and remote refs

## Summary Nx core builds several `git` invocations as shell command strings with untrusted values interpolated into th

历史摘要 · 未重新核验 · GitHub Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the ser...

CVE-2026-105740

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflo

历史摘要 · 未重新核验 · NVD

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an ...

CVE-2026-105697

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio tra

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c...

CVE-2026-105767

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action

历史摘要 · 未重新核验 · NVD

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask comm...

CVE-2026-105691

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlle

历史摘要 · 未重新核验 · NVD

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver....

CVE-2026-105134

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/

历史摘要 · 未重新核验 · NVD

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async

历史摘要 · 未重新核验 · GitHub Advisory

A specially crafted HTTP POST request to the web administration interface allows an...

CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute

历史摘要 · 未重新核验 · GitHub Advisory

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges ...

CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute

历史摘要 · 未重新核验 · NVD

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1....

CVE-2026-104019

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12,

历史摘要 · 未重新核验 · NVD

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image ...

CVE-2026-104859

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1,

历史摘要 · 未重新核验 · NVD