Vulnerabilities
Roundcube Webmail Patches Command Injection and XSS Flaws
The Roundcube team released security updates on Oct 19 to address multiple vulnerabilities, including command injection, in versions prior to 1.6.20 and 1.7.5.
command injection
Everything Vuln Post has reported about command injection: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
Nextcloud richdocumentscode Command Injection Patch Blocks Unauthenticated Remote Code Execution
Users of the richdocumentscode app must upgrade to version 26.4.303 to stop remote attackers from executing operating system commands without credentials.
Vulnerabilities
Critical Command Injection in Claude Agent SDK Python Versions Before 0.2.121
Anthropic releases patch for CVE-2026-96620, a critical flaw allowing arbitrary command execution via unvalidated resume parameters in the Python SDK.
Vulnerabilities
Markdown Preview Enhanced Fixes Remote Code Execution in VS Code Extension
A high-severity command injection flaw in the Markdown Preview Enhanced extension allows attackers to run system commands via crafted links, now patched in version 0.8.28.
Vulnerabilities
MoviePilot Command Injection Flaw Allows Remote Code Execution
A high-severity flaw in MoviePilot through 3.1.5 lets attackers run system commands via crafted content, with no patch confirmed yet.
Vulnerabilities
Dokku RCE Risk: Unsafe Bash Eval in Docker Options Patched in 0.38.25
A critical flaw in Dokku versions before 0.38.25 allows remote code execution via the docker-options plugin, but a patch is now available.