Rezultati pretraživanja za 'Od datuma: 01.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-117568 | 7.0 | mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $( | 2026-10-27 16:04:22 | 2026-10-27 14:16:39 |
| CVE-2026-117567 | 7.8 | esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection ca | 2026-10-27 16:04:22 | 2026-10-27 14:16:39 |
| CVE-2026-117566 | 5.3 | EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img | 2026-10-27 16:04:22 | 2026-10-27 14:16:39 |
| CVE-2026-117565 | 5.3 | Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an i | 2026-10-27 16:04:22 | 2026-10-27 14:16:38 |
| CVE-2026-117564 | 9.8 | nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret | 2026-10-27 16:04:22 | 2026-10-27 14:16:38 |
| CVE-2026-117562 | 5.3 | rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the | 2026-10-27 16:04:22 | 2026-10-27 14:16:38 |
| CVE-2026-117561 | 7.8 | Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $ | 2026-10-27 16:04:22 | 2026-10-27 14:16:38 |
| CVE-2026-117560 | 7.8 | ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to i | 2026-10-27 16:04:22 | 2026-10-27 14:16:38 |
| CVE-2026-117559 | 7.8 | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parame | 2026-10-27 16:04:22 | 2026-10-27 14:16:37 |
| CVE-2026-117558 | 7.8 | The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue vie | 2026-10-27 16:04:22 | 2026-10-27 14:16:37 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/13496
Zapisa po stranici: