Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-41691 is a path traversal and URL injection vulnerability in i18next-http-backend versions prior to 3.0.5. The issue arises because the library interpolates language (lng) and namespace (ns) values directly into URL templates without encoding or sanitization. This allows an attacker controlling these inputs to manipulate the request URL structure, potentially accessing restricted paths. The vulnerability has been fixed in version 3.0.5. Until upgrading, users can mitigate risk by sanitizing lng and ns inputs to remove dangerous characters and limit length.
A vulnerability was determined in baomidou dynamic-datasource 2.5.0. Affected by this vulnerability is the function DsSpelExpressionProcessor#doDetermineDatasource of the file dynamic-datasource-spring/src/main/java/com/baomidou/dynamic/datasource/processor/DsSpelExpressionProcessor.java of the component StandardEvaluationContext/SpelExpressionParser. This manipulation causes injection. The attack may be initiated remotely. Patch name: 273fcedaee984c08197c0890f14190b86ab7e0b8. It is recommended to apply a patch to fix this issue.
CVE-2026-7039 is a high-severity command injection vulnerability in tufantunc ssh-mcp versions up to 1.5.0. The flaw exists in the shell.write function of src/index.ts, where manipulation of the Description argument allows local attackers to execute arbitrary commands. Exploit code has been publicly disclosed, but the vendor has not yet responded or issued a fix. The attack requires local access and does not involve user interaction. No official patch or remediation guidance is currently available.
CVE-2026-7028 is a medium severity SQL injection vulnerability in CodeAstro Online Job Portal version 1.0. It affects an unknown function in the /admin/jobs-admins/delete-jobs.php file within the All Jobs Page component. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to perform SQL injection. Although an exploit has been publicly released, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.
A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_mutation/header_mutation.cc of the component Query Parameter Handler. This manipulation causes injection. Remote exploitation of the attack is possible. Patch name: f8f4f1e02fdc64ecd4acf2d903208dd7285ad3a4. It is suggested to install a patch to address this issue.
A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Tenda F453 up to 1.0.0.3. Impacted is the function TendaTelnet of the file /goform/telnet of the component Telnet Service. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."
A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
The Quiz And Survey Master (QSM) WordPress plugin up to version 11.1.0 is vulnerable to arbitrary shortcode execution due to improper sanitization of user-submitted quiz answers. The plugin executes do_shortcode() on quiz results output, allowing injected shortcodes to run. This enables unauthenticated attackers to inject shortcodes like [qsm_result id=X] to view other users' quiz submissions without authorization. The vulnerability arises because sanitize_text_field() and htmlspecialchars() do not remove shortcode brackets, and the qsm_result shortcode lacks authorization checks.
CVE-2026-39419 is a vulnerability in MaxKB versions 2.7.1 and below that allows an authenticated user to bypass sandbox result validation and spoof tool execution results. The attacker exploits Python frame introspection to read a UUID from bytecode constants and writes a forged result directly to file descriptor 1, bypassing stdout redirection. By calling sys.exit(0), the attacker terminates the wrapper before legitimate output is printed, causing the service to trust the spoofed response. This issue is fixed in version 2.8.0.
A vulnerability in the NestJS framework prior to version 11.1.18 allows improper neutralization of newline characters in Server-Sent Events (SSE) output. Specifically, the SseStream. _transform() method interpolates message.type and message.id directly into SSE text output without sanitizing carriage return and newline characters. This can enable an attacker who controls these fields to inject arbitrary SSE events, spoof event types, and disrupt reconnection state. The issue is fixed in version 11.1.