Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18,509 results · page 1 of 371
Oct 29, 2026Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport CVE-2026-107044 · Other software · reported by MITRE
Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgf-droid.org
Oct 29, 2026An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command executCVE-2026-90868 · Other software · Progress Software · reported by security@progress.comCritical 9.9
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprogress.lightning.force.com
Oct 29, 2026An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command executCVE-2026-90865 · Other software · Progress Software · reported by security@progress.comCritical 9
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
- Product
- WS_FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprogress.lightning.force.com
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.CVE-2026-110309 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.CVE-2026-103092 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Broken Function Level Authorization allows execution of poller post-restart commands by authenticated userCVE-2025-13050 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Medium 5.4
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.comundefined
Oct 29, 2026Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's prCVE-2026-107018 · Other software · reported by MITRE
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39736 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
- Product
- JetEngine
- Affected
- up to 3.9.0.1
- What to do
- Affects up to 3.9.0.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.CVE-2026-97854 · Other software · Yamaha Corporation · reported by vultures@jpcert.or.jpCritical 9.3
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
- Product
- NWR100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jprtpro.yamaha.co.jp
Oct 29, 2026open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows anCVE-2026-119025 · Other software · sindresorhus · reported by VulnCheckHigh 7.7
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
- Product
- open
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents.CVE-2026-33924 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.5
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.com
Oct 29, 2026BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115965 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
- Product
- BuddyPress
- Affected
- up to 14.5.2
- What to do
- Affects up to 14.5.2. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Motors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115964 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
- Product
- Motors
- Affected
- up to 1.4.126
- What to do
- Affects up to 1.4.126. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an aCVE-2026-66088 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fCritical 9.4
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
- Product
- openEQUELLA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenequella.github.io
Oct 28, 2026Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unCVE-2026-118755 · Other software · Volmarg · reported by VulnCheckHigh 8.6
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
- Product
- personal-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell CVE-2026-118692 · Other software · giuspen · reported by VulnCheckHigh 7.1
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
- Product
- cherrytree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`.CVE-2026-105616 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.7
PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability.CVE-2026-118615 · Other software · Ultralytics · reported by zdi-disclosures@trendmicro.comHigh 7.8
Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.
- Product
- Ultralytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Alpine iLX-F511 diagapp Command Injection Vulnerability.CVE-2026-118607 · Other software · Alpine · reported by zdi-disclosures@trendmicro.comMedium 6.8
Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28750.
- Product
- iLX-F511
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent LauncCVE-2026-117614 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart RCVE-2026-106079 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.8
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allowCVE-2026-103406 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.8
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- Product
- Session Smart Conductor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart RCVE-2026-103403 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.8
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115603 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.
- Product
- Advanced Ads – Tracking
- Fixed in
- 4.0.0
- What to do
- Update Advanced Ads – Tracking to 4.0.0 or newer.
Oct 28, 2026DXP ToolKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-115607 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
- Product
- DXP ToolKit
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update DXP ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111850 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
- Product
- BuddyPress
- Affected
- up to 14.5.2
- What to do
- Affects up to 14.5.2. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111411 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
- Product
- FunnelKit Automations
- Affected
- up to 3.8.5.2
- What to do
- Affects up to 3.8.5.2. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection.CVE-2026-118477 · Other software · EISGE · reported by 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fdHigh 8.7
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
- Product
- Kalifast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.orangecyberdefense.com
Oct 28, 2026The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/CVE-2026-114278 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
- Product
- Eclipse Che
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 27, 2026Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delCVE-2013-20007 · Network & remote access · Linksys · reported by VulnCheckHigh 8.6
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
- Product
- WAG200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.coms3cur1ty.de
Oct 27, 2026Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandboxCVE-2026-118355 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 27, 2026Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with CVE-2026-112351 · Other software · Sunhillo Corporation · reported by VulnCheckHigh 8.7
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
- Product
- SureLine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunhillo.comvulncheck.com
Oct 27, 2026An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3.CVE-2026-102815 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.9
An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can triggCVE-2026-113775 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-105781 · Other software · Adobe · reported by AdobeCritical 10
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-105779 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-105489 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could resCVE-2026-104354 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that couCVE-2026-104353 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Campaign Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least reaCVE-2026-90464 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7.2
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into CVE-2026-117573 · Other software · masc-ucsc · reported by VulnCheckHigh 8.5
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
- Product
- hagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run CVE-2026-117569 · Other software · alishahid74 · reported by VulnCheckHigh 8.5
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
- Product
- kali-gpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir CVE-2026-117568 · Other software · bitscorp-mcp · reported by VulnCheckHigh 7.3
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
- Product
- mcp-ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters CVE-2026-117567 · Other software · horw · reported by VulnCheckHigh 8.5
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
- Product
- esp-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLCVE-2026-117561 · Other software · codefriar · reported by VulnCheckHigh 8.5
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
- Product
- sf-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsaCVE-2026-117560 · Other software · atxp · reported by VulnCheckHigh 8.5
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.
- Product
- gemini-cli-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick subCVE-2026-117559 · Other software · hyperb1iss · reported by VulnCheckHigh 8.5
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
- Product
- droidmind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metachaCVE-2026-117558 · Other software · ai-sdlc-framework · reported by VulnCheckHigh 8.5
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
- Product
- ai-sdlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control CVE-2026-13162 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.7
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
- Product
- CoreTec 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 27, 2026In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commandsCVE-2026-117530 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.7
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
- Product
- Junie CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.