Search Vulnerabilities

Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

Git source checkout from a bundle file could lead to command injection

FreeRDP RDP File Parser Remote Code Execution via CLI Options

dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Wekan: Shell Injection via Avatar Upload

Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Metabase: Arbitrary File Read via MySQL Connection Property Injection

Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Argument Injection in TUBITAK BILGEM's pardus-software

Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Cacti: Command Injection via escape_command() no-op in RRDtool execution

Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path