#cwe-78

共收录 1647 条相关情报。

← 返回所有主题

安全公告2026-07-16 发布INFO

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

CVE-2026-55578

### Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-78 #severity:high

安全公告2026-07-16 发布INFO

Pheditor has an authenticated terminal command whitelist bypass

CVE-2026-54540

### Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-78 #severity:high

漏洞预警2026-07-16 发布INFO

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controll...

CVE-2026-47751

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-200

漏洞预警2026-07-16 发布INFO

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing...

CVE-2026-14371

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-16 发布INFO

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior ...

CVE-2026-45695

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-en

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-306

安全公告2026-07-16 发布INFO

Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

CVE-2026-47751

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-78

安全公告2026-07-16 发布INFO

Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

CVE-2026-45695

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-en

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-306 #cwe-78

漏洞预警2026-07-16 发布INFO

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command...

CVE-2026-63305

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-16 发布INFO

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keywo...

CVE-2026-63304

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the list

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-07-16 发布INFO

AVideo through 29.0 OS Command Injection via ffmpeg.json.php

CVE-2026-63305

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-07-16 发布INFO

AVideo through 29.0 OS Command Injection via listFFmpegProcesses

CVE-2026-63304

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the list

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-07-16 发布INFO

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.

CVE-2023-49900

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-07-15 发布INFO

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

CVE-2026-50289

### Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Deb

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-78 #severity:high

漏洞预警2026-07-15 发布INFO

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github...

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/r

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-94

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() fo...

CVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-88

安全公告2026-07-15 发布INFO

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might...

CVE-2026-15895

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-07-15 发布INFO

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combini...

CVE-2026-62312

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitra

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-15 发布INFO

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored Post...

CVE-2026-55410

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-07-15 发布INFO

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated regi...

CVE-2026-46339

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-306

安全公告2026-07-15 发布INFO

Wekan: Shell Injection via Avatar Upload

CVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied fil

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78 #cwe-88