CVE-2026-90865
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbi
CVSS
9.0
Crítica
EPSS
1.1%
p67
KEV
—
Exploit Today
20
0-100
Publicado: 29 de out. de 2026 · Última mod.: 30 de out. de 2026 · CWE-78 · CWE-88
1.1%EPSS · 30 dias1.1%
2026-10-302026-11-07
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-174109.9 CRÍ51.6%
——15IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.1dCVE-2026-174089.8 CRÍ60.7%
——18IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.1dCVE-2026-174029.9 CRÍ79.9%
——24IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.1dCVE-2026-170622.7 BAI31.8%
——10IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.1dCVE-2026-1026106.4 MÉD21.8%
——7fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.2dCVE-2026-330508.8 ALT51.5%
——15GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.2d