CVE-2026-117573 is an OS command injection vulnerability in the hagent project (version 0). It allows MCP clients to execute arbitrary shell commands by injecting special characters into the args parameter of the hagent_arduino and hagent_esp32 tools. The vulnerability arises because these args are interpolated unsafely into subprocess.run calls with shell=True, enabling command execution as the MCP server user.
CVE-2026-117570 is a vulnerability in Vorota-ai nmap-mcp (version 0) where the scan_vulnerabilities tool improperly validates its allowlist of NSE script categories. This flaw allows callers, including MCP clients or prompt-injected agents, to bypass restrictions and run blocked script categories such as exploit, dos, brute, or intrusive against scan targets.
Kali-GPT version 0 contains an OS command injection vulnerability in the execute_tool() function within kali_gpt/tools/mcp_server.py. This flaw allows MCP clients to execute arbitrary OS commands by injecting shell metacharacters into parameters such as target, ports, domain, wordlist, or url. The vulnerability arises because these parameters are passed unsanitized to subprocess.run with shell=True, running with the MCP server user's privileges.
mcp-ffmpeg versions up to 1.0.5 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted input values for videoPath or outputDir parameters in certain tools. The vulnerability arises from improper neutralization of special shell characters, enabling command string breakouts and execution with the MCP server user's privileges.
CVE-2026-117567 is an OS command injection vulnerability in esp-mcp (horw project) up to commit 28afddf. It allows attackers to execute arbitrary OS commands by injecting shell metacharacters into parameters used by the MCP tool. The vulnerability arises when attacker-controlled input is passed to asyncio.create_subprocess_shell without proper sanitization, enabling command execution as the MCP server user.
EasyImages2.0 versions up to 2.8.6 have an unauthenticated path traversal vulnerability in several PHP scripts that allows attackers to read files outside the intended upload directory by using directory traversal sequences in certain parameters.
Artalk versions before 2.10.1 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to submit anonymous comments with a crafted page_key parameter pointing to internal URLs. The server fetches these URLs to retrieve page titles without proper validation beyond scheme checking, exposing internal resources via the public comment list.
nest-admin versions before 1.0.1 contain a critical authentication bypass vulnerability due to a hardcoded JWT secret key. This allows unauthenticated attackers to forge administrator tokens and gain full administrative access by impersonating any user or claiming admin roles.
MrDoc versions up to 1.1.1 have a broken access control vulnerability that allows authenticated users to modify document share settings of other users. This occurs because the application does not verify ownership when updating share settings. Attackers can predict share tokens by computing the MD5 hash of the document ID and username, enabling them to re-enable disabled shares or remove access codes, potentially exposing private documents.
rssant versions 1.9.0 through 1.9.1 have an authorization bypass vulnerability allowing unauthenticated attackers to read stories from unpublished feeds via the anonymous publish.story_get endpoint. This occurs because the UnionStory.get_by_feed_offset function ignores the only_publish flag, enabling enumeration of feed IDs and offsets to access private feed stories.
Codefriar sf-mcp versions up to 1.3.2 contain an OS command injection vulnerability. This flaw arises because the escapeValue() function does not properly neutralize shell metacharacters such as backticks and $() substitutions. As a result, crafted Salesforce CLI tool flag values can lead to arbitrary shell command execution with the privileges of the MCP server user. The vulnerability has a high severity score of 8.5 and affects all versions from 0 up to and including 1.3.2. A patch is available, and since this is a cloud service, the vendor manages remediation server-side.
ATXP Gemini CLI extension versions up to 1.0.0 contain an OS command injection vulnerability in the runAtxp() function. This flaw allows attackers to execute arbitrary shell commands by injecting special shell substitution syntax into unsanitized parameters such as message_id, subject, or query. The injection can be triggered via crafted email or SMS content, leading to command execution with the privileges of the user running the CLI extension.
DroidMind versions up to 0.4.0 have a command injection vulnerability that allows attackers to bypass shell command allowlists using command substitution techniques. This enables execution of restricted commands like reboot on connected Android devices via certain Device methods.
An OS command injection vulnerability exists in the ai-sdlc plugin MCP server up to version 0.31.2. This flaw allows attackers with limited privileges to execute arbitrary OS commands by injecting shell metacharacters into the 'repo' argument. The vulnerability arises because the unvalidated 'repo' input is directly interpolated into commands executed via execSync(), specifically 'gh issue view' or 'gh pr view'.
SDL_image versions up to 2.8.12 and 3.4.8 contain a stack out-of-bounds read vulnerability in the IMG_LoadLBM_IO() function. This occurs due to missing validation of the bitplane count when HAM mode is enabled, allowing crafted ILBM files with excessive HAM bitplanes to cause memory disclosure or crashes.
CVE-2026-117556 is a heap out-of-bounds read vulnerability in zchunk versions before 1.5.5. The flaw occurs in the read_preface() function where the total header length is incorrectly passed to compressed integer parsing functions, leading to reads beyond the allocated heap buffer. A crafted .zck file with a header ending inside a compressed integer can trigger this, causing application crashes.
CImg versions up to 4.0.6 have a heap out-of-bounds read vulnerability in the _load_bmp() function caused by an integer overflow in calculating the row byte count. This flaw allows an attacker to craft a malicious BMP file with a large header width that causes the byte count to wrap, potentially leading to crashes or disclosure of heap memory into the decoded image.
Admidio versions prior to 5.0.17 have an improper access control vulnerability that allows authenticated users to bypass server-side restrictions on event guest registration. Specifically, attackers can manipulate the additional_guests field to register more guests than allowed, exhausting event capacity and preventing other users from registering.
Umbraco CMS versions before 17.7.2 and 18.2.2 contain an authentication bypass vulnerability via an open redirect flaw. This allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by manipulating the Host header. Exploitation involves sending signed-in users authorization links with response_mode=form_post to capture authorization codes, which attackers then redeem using HTTP Basic client credentials. Successful exploitation can hijack back-office sessions and execute code through Razor templates.
Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.