A critical OS command injection vulnerability exists in the Ping Diagnostic component of Linksys WRT54GL version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. The vulnerability is publicly known with available exploit code. However, the affected product is no longer supported by the vendor, and no patch or official response has been provided.
A cross-site scripting (XSS) vulnerability exists in EmpireSoft EmpireCMS up to version 8.0 in the /e/member/mspace/index.php file. The flaw is triggered by manipulation of the spacename argument and can be exploited remotely. Public exploit code is available, but the vendor has not responded or issued a fix. The CVSS score is 3.5, indicating low severity.
A critical remote command injection vulnerability exists in the Traceroute Diagnostic Function of Linksys WRT54GL firmware version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the traceroute_ip argument allows an attacker with high privileges to execute arbitrary OS commands. This vulnerability affects an unsupported product, and no vendor response or patch is available. Public exploit code has been disclosed.
Invoice Ninja versions before 5.13.28 have a broken access control vulnerability that allows authenticated vendor-portal users to access documents of other vendors and clients. This occurs because authorization checks validate only company_id scope instead of verifying vendor ownership. Attackers can exploit predictable sequential Hashids document identifiers due to a default empty HASH_SALT to download invoice PDFs, contracts, payment receipts, and expense attachments belonging to other vendors within the same company.
Node Version Manager (nvm) versions 0.40.0 through 0.40.8 contain a vulnerability where the commands 'nvm use --save' and 'nvm install --save' write the resolved Node.js version string to a .nvmrc file in the current directory using 'tee', which follows symbolic links. If the .nvmrc file is a symlink to a file outside the repository, this can cause unintended truncation and overwriting of arbitrary writable files, such as shell startup files or SSH authorized_keys, resulting in data loss. Version 0.41.0 fixes this by refusing to write to .nvmrc if it is a symlink, issuing a warning instead.
Alan: Health Insurance for Android version 1.450.0 contains a path traversal vulnerability in its exported ShareReceiverActivity. This flaw allows a malicious app on the same device to write files outside the intended directory by exploiting an unsanitized _display_name parameter. Attackers can overwrite sensitive files within the app's sandbox, such as databases and WebView data, potentially enabling state tampering or code execution without user interaction or authentication.
Node Version Manager (nvm) versions 0.5.0 through 0.40.8 contain an argument injection vulnerability (CWE-88) where version patterns from a .nvmrc file starting with '-' are interpreted as grep options. This causes unintended recursive directory searches, potentially leaking sensitive data such as npm tokens from symlinked files to terminal output and logs. The issue is fixed in version 0.41.0 by passing version patterns to grep with the '-e' option.
Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not properly check if the .nvmrc file is a symbolic link. This allows an attacker to craft a symlinked .nvmrc pointing to arbitrary files, causing nvm commands to read and print the contents of those files in command output or logs. Version 0.41.0 fixes this by not printing the contents of symlinked .nvmrc files and only accepting valid version strings or aliases.
CVE-2026-122016 is a medium severity vulnerability in yangzongzhuan RuoYi-Vue versions 3.9.0, 3.9.1, and 3.9.2. It involves improper privilege management in the SysPermissionService.getMenuPermission function, allowing remote attackers to manipulate permissions arguments. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
Node Version Manager (nvm) versions 0.27.0 through 0.40.8 contain a vulnerability where the 'nvm use --delete-prefix' command can cause npm to rewrite arbitrary configuration files chosen by a project's .npmrc file. This can corrupt files such as ~/.bashrc or leave configuration files with insecure permissions, potentially allowing local users on shared machines to modify them. The vulnerability is fixed in version 0.41.0, which prevents a project .npmrc from selecting which config file is edited.
Node Version Manager (nvm) versions 0.40.5 through 0.40.8 have a vulnerability where a downloaded release archive is cached before checksum verification. If the checksum fails, the corrupted archive remains in the cache and can be installed later using 'nvm install --offline' without re-verifying the checksum, allowing execution of potentially malicious code. This issue is fixed in version 0.41.0, which only caches archives after successful checksum verification.
Node Version Manager (nvm) versions 0.40.0 through 0.40.8 have a vulnerability where the authorization header set in NVM_AUTH_HEADER is passed as a visible command-line argument to curl or wget during downloads. This exposure allows other local users on the same machine to potentially read sensitive tokens via process listings. The issue is fixed in version 0.41.0, which changes the method of passing the header to avoid command-line exposure.
Node Version Manager (nvm) versions 0.39.6 through 0.40.8 contain an OS command injection vulnerability in the handling of remote LTS aliases. The vulnerability arises because the version column from the mirror's index.tab file is stored without validation and later evaluated in shell arithmetic, allowing command substitution execution under bash and zsh. Exploitation requires use of a hostile mirror or man-in-the-middle attack and running affected nvm commands. The issue is fixed in version 0.41.0 by restricting arithmetic evaluation to numeric offsets and dropping invalid version strings.
CVE-2026-102894 is a critical authentication bypass vulnerability in GPUStack versions from 0.7.1 up to but not including 2.2.2. The vulnerability occurs because the /auth/saml/callback endpoint fails to verify SAML response signatures and related security conditions, allowing attackers to impersonate existing users or provision new accounts without proper authentication. This flaw is fixed in version 2.2.2.
CVE-2026-102895 is a critical improper authentication vulnerability in GPUStack versions prior to 2.2.0. The flaw allowed remote attackers to bypass authentication by exploiting how loopback requests were treated as administrator requests when force_auth_localhost was false. This led to unauthenticated administrative access, enabling changes to users and models, creation of persistent admin API keys, disclosure of secrets, and remote code execution. The issue was fixed in version 2.2.0.
CVE-2026-122015 is a medium severity vulnerability in NPC-Worldwide npcpy versions 2.1.0 through 2.1.19. It involves improper input validation in the get_mlx_response function of the MLX Provider component, specifically in the npcpy/gen/response.py file. The vulnerability can be exploited remotely by manipulating the 'model' argument. Public exploit code is available, but there are no known exploits in the wild. No patch or remediation information is provided.
CVE-2026-97693 is a critical command injection vulnerability in the Yuxi platform versions from 0.6.0.beta1 up to but not including 0.7.1. It allows a low-privileged authenticated user with command execution in their own Docker sandbox to access and manipulate other tenants' sandboxes and data without needing administrator credentials. The vulnerability arises from insufficient isolation between Docker sandboxes and trusted services, enabling cross-tenant API access, file and secret exposure, sandbox management, and potential command execution in shared internal services if default credentials remain unchanged. The issue is fixed in version 0.7.1, but deployments must also rotate persisted credentials for PostgreSQL, Neo4j, and MinIO if they were set to default values, as upgrading alone does not rotate these credentials.
Jan versions from 0.8.5 up to but not including 0.8.8 have a vulnerability that allows attackers to bypass workspace protections and write files outside the intended workspace by exploiting dangling symbolic links. This can be triggered by supplying a malicious repository and using prompt injection to cause file write or edit tools to follow symlinks, potentially creating sensitive files such as ~/.ssh/authorized_keys on the host system.
jsondiffpatch versions before 0.7.7 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup by providing an unescaped array-move destination index in a delta object. Exploitation requires control over the delta passed to the formatters.html.format() or formatters.annotated.format() functions, enabling script execution in the application's origin context. The vulnerability is fixed in version 0.7.7.
CVE-2026-122233 is an information disclosure vulnerability in FrankenPHP versions before 1.13.4. The flaw occurs in worker mode where the last HTTP stream response headers are not cleared between requests because the reset only happens during RSHUTDOWN, which worker requests skip. This allows subsequent requests on the same worker thread to access headers from previous requests, potentially exposing sensitive headers such as Set-Cookie or tokens from backend APIs.