VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Succe...

CVE-2026-16812

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

历史摘要 · 未重新核验 · NVD

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code ...

CVE-2025-59172

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vuln

历史摘要 · 未重新核验 · NVD

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker w...

CVE-2026-59688

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

历史摘要 · 未重新核验 · NVD

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker w...

CVE-2026-59687

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

历史摘要 · 未重新核验 · NVD

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker w...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection M

历史摘要 · 未重新核验 · NVD

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash,...

CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with ar

历史摘要 · 未重新核验 · GitHub Advisory

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. Ja...

CVE-2026-17497

NoteGen 是一个笔记应用，使用 Tauri 框架构建。在版本 0.32.0 之前，其默认桌面功能配置错误地授予了 Tauri shell 插件的 shell:allow-execute 权限，允许执行 bash、python、pyth

历史摘要 · 未重新核验 · NVD

NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with ar

历史摘要 · 未重新核验 · OSV.dev

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command wi...

CVE-2026-16766

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.

历史摘要 · 未重新核验 · NVD

Shescape: Shell injection via unescaped parentheses on Windows with CMD

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the defau

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Path disclosure on Unix with Zsh

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects

历史摘要 · 未重新核验 · GitHub Advisory

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default...

CVE-2026-63732

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authent

历史摘要 · 未重新核验 · GitHub Advisory

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote...

CVE-2026-6516

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. ...

CVE-2026-16631

CVE-2026-16631 是一个存在于 publint 工具（版本 <=0.1.4）中的操作系统命令注入漏洞。漏洞位于 src/node/pack.js 文件的 child_process.exec 函数中，该函数作为包管理器命令处理器

历史摘要 · 未重新核验 · NVD

publint package-manager pack.js child_process.exec os command injection

CVE-2026-16631

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/p

历史摘要 · 未重新核验 · OSV.dev

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The mani...

CVE-2026-16630

该漏洞存在于 Syncfusion 的 ej2-javascript-ui-controls 组件中，影响版本至 33.2.3。漏洞源于在 package.json 文件中调用了 child_process.exec 函数，攻击者可利用该函

历史摘要 · 未重新核验 · NVD

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

CVE-2026-65590

## Impact The shell tool in the `@n8n/computer-use` package applied its sandbox restrictions only on macOS. On Linux and

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the com...

CVE-2026-16629

该漏洞影响 danger-js 组件（一个用于 CI 的 JavaScript 安全审查工具）的 13.0.7 及之前版本。漏洞位于 source/platforms/git/localGetFileAtSHA.ts 文件中的 danger

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performing a ma...

CVE-2026-16628

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec o

历史摘要 · 未重新核验 · NVD