Electrum versions before 4.7.2 have a critical TOCTOU race condition vulnerability in the Nostr Wallet Connect plugin. This flaw allows malicious clients to bypass the daily spending limit by exploiting non-atomic budget checks and truncation of millisatoshi amounts. Attackers can send concurrent payment requests or repeatedly pay amounts that are rounded down, enabling them to drain funds beyond the intended limit.
Electrum versions from 0 up to 4.7.2 have an authorization bypass vulnerability in the external plugin loader. This flaw allows execution of a plugin's __init__.py module if the plugin is marked enabled in the config file, without verifying the plugin's password signature. A local attacker with write access to the Electrum data directory can exploit this to execute arbitrary code within the Electrum process. The issue is fixed in version 4.7.2.
Electrum versions before 4.8.3 have a vulnerability where the software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This flaw allows malicious servers to replace a user's just-broadcast transaction with a conflicting transaction that appears to have zero fees and pays an attacker address. Users can be tricked into performing Replace-By-Fee (RBF) fee-bumping on this invalid transaction, effectively losing funds to the attacker. The issue is fixed in Electrum version 4.8.3.
CVE-2026-117573 is an OS command injection vulnerability in the hagent project (version 0). It allows MCP clients to execute arbitrary shell commands by injecting special characters into the args parameter of the hagent_arduino and hagent_esp32 tools. The vulnerability arises because these args are interpolated unsafely into subprocess.run calls with shell=True, enabling command execution as the MCP server user.
CVE-2026-117570 is a vulnerability in Vorota-ai nmap-mcp (version 0) where the scan_vulnerabilities tool improperly validates its allowlist of NSE script categories. This flaw allows callers, including MCP clients or prompt-injected agents, to bypass restrictions and run blocked script categories such as exploit, dos, brute, or intrusive against scan targets.
Kali-GPT version 0 contains an OS command injection vulnerability in the execute_tool() function within kali_gpt/tools/mcp_server.py. This flaw allows MCP clients to execute arbitrary OS commands by injecting shell metacharacters into parameters such as target, ports, domain, wordlist, or url. The vulnerability arises because these parameters are passed unsanitized to subprocess.run with shell=True, running with the MCP server user's privileges.
mcp-ffmpeg versions up to 1.0.5 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted input values for videoPath or outputDir parameters in certain tools. The vulnerability arises from improper neutralization of special shell characters, enabling command string breakouts and execution with the MCP server user's privileges.
CVE-2026-117567 is an OS command injection vulnerability in esp-mcp (horw project) up to commit 28afddf. It allows attackers to execute arbitrary OS commands by injecting shell metacharacters into parameters used by the MCP tool. The vulnerability arises when attacker-controlled input is passed to asyncio.create_subprocess_shell without proper sanitization, enabling command execution as the MCP server user.
EasyImages2.0 versions up to 2.8.6 have an unauthenticated path traversal vulnerability in several PHP scripts that allows attackers to read files outside the intended upload directory by using directory traversal sequences in certain parameters.
Artalk versions before 2.10.1 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to submit anonymous comments with a crafted page_key parameter pointing to internal URLs. The server fetches these URLs to retrieve page titles without proper validation beyond scheme checking, exposing internal resources via the public comment list.
nest-admin versions before 1.0.1 contain a critical authentication bypass vulnerability due to a hardcoded JWT secret key. This allows unauthenticated attackers to forge administrator tokens and gain full administrative access by impersonating any user or claiming admin roles.
MrDoc versions up to 1.1.1 have a broken access control vulnerability that allows authenticated users to modify document share settings of other users. This occurs because the application does not verify ownership when updating share settings. Attackers can predict share tokens by computing the MD5 hash of the document ID and username, enabling them to re-enable disabled shares or remove access codes, potentially exposing private documents.
rssant versions 1.9.0 through 1.9.1 have an authorization bypass vulnerability allowing unauthenticated attackers to read stories from unpublished feeds via the anonymous publish.story_get endpoint. This occurs because the UnionStory.get_by_feed_offset function ignores the only_publish flag, enabling enumeration of feed IDs and offsets to access private feed stories.
Codefriar sf-mcp versions up to 1.3.2 contain an OS command injection vulnerability. This flaw arises because the escapeValue() function does not properly neutralize shell metacharacters such as backticks and $() substitutions. As a result, crafted Salesforce CLI tool flag values can lead to arbitrary shell command execution with the privileges of the MCP server user. The vulnerability has a high severity score of 8.5 and affects all versions from 0 up to and including 1.3.2. A patch is available, and since this is a cloud service, the vendor manages remediation server-side.
ATXP Gemini CLI extension versions up to 1.0.0 contain an OS command injection vulnerability in the runAtxp() function. This flaw allows attackers to execute arbitrary shell commands by injecting special shell substitution syntax into unsanitized parameters such as message_id, subject, or query. The injection can be triggered via crafted email or SMS content, leading to command execution with the privileges of the user running the CLI extension.
DroidMind versions up to 0.4.0 have a command injection vulnerability that allows attackers to bypass shell command allowlists using command substitution techniques. This enables execution of restricted commands like reboot on connected Android devices via certain Device methods.
An OS command injection vulnerability exists in the ai-sdlc plugin MCP server up to version 0.31.2. This flaw allows attackers with limited privileges to execute arbitrary OS commands by injecting shell metacharacters into the 'repo' argument. The vulnerability arises because the unvalidated 'repo' input is directly interpolated into commands executed via execSync(), specifically 'gh issue view' or 'gh pr view'.
SDL_image versions up to 2.8.12 and 3.4.8 contain a stack out-of-bounds read vulnerability in the IMG_LoadLBM_IO() function. This occurs due to missing validation of the bitplane count when HAM mode is enabled, allowing crafted ILBM files with excessive HAM bitplanes to cause memory disclosure or crashes.
CVE-2026-117556 is a heap out-of-bounds read vulnerability in zchunk versions before 1.5.5. The flaw occurs in the read_preface() function where the total header length is incorrectly passed to compressed integer parsing functions, leading to reads beyond the allocated heap buffer. A crafted .zck file with a header ending inside a compressed integer can trigger this, causing application crashes.
CImg versions up to 4.0.6 have a heap out-of-bounds read vulnerability in the _load_bmp() function caused by an integer overflow in calculating the row byte count. This flaw allows an attacker to craft a malicious BMP file with a large header width that causes the byte count to wrap, potentially leading to crashes or disclosure of heap memory into the decoded image.