Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-46420exploit | 9.8 critical | 2.0% | shivammathur, setup_php | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1. | Sat 24 Oct |
| CVE-2026-107780 | 9.3 critical | 2.0% | no CPE yet | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows. | 13 Oct |
| CVE-2026-45322 | 7.8 high | 2.0% | no CPE yet | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.run_shell() passes a command string from action parameters directly to subprocess.Popen() with shell=True and executable=powershell.exe. The same shell-execution behavior is also reachable through ShellReceiver.execute_command(). The shell receiver is invoked by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters to the shell receiver. Because UFO stores planned and executed actions in per-session JSON records, an attacker who can write or modify a session/action JSON file can plant a shell action. When the session is resumed or replayed, UFO executes the attacker's command as the UFO process user. | Mon 26 Oct |
| CVE-2026-26171 | 7.5 high | 2.0% | microsoft, .net, powershell | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-83578 | 9.8 critical | 1.0% | no CPE yet | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-107779 | 9.3 critical | 1.0% | no CPE yet | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs. | 14 Oct |
| CVE-2026-49255 | 8.8 high | 1.0% | no CPE yet | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11. | Tue 27 Oct |
| CVE-2026-14371 | 8.8 high | 1.0% | no CPE yet | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands. | Sat 24 Oct |
| CVE-2026-16800 | 8.8 high | 1.0% | devolutions, powershell_universal | Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation. | Sat 24 Oct |
| CVE-2026-16801 | 8.8 high | 1.0% | devolutions, powershell_universal | Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. | Sat 24 Oct |
| CVE-2026-96251 | 8.8 high | 1.0% | microsoft, powershell | Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. | Thu 22 Oct |
| CVE-2026-70337 | 8.8 high | 1.0% | microsoft, powershell 7.4, powershell 7.5, powershell 7.6 | Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. | 21 Oct |
| CVE-2026-85817 | 8.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network. | 16 Oct |
| CVE-2026-26143 | 7.8 high | 1.0% | microsoft, powershell | Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. | Mon 26 Oct |
| CVE-2026-58612 | 7.4 high | 1.0% | microsoft, powershell 7.4, powershell 7.5, powershell 7.6 | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. | 7 h ago |
| CVE-2026-96303 | 6.5 medium | 1.0% | microsoft, powershell | Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network. | Thu 22 Oct |
| CVE-2026-85805 | 6.5 medium | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | 16 Oct |
| CVE-2026-48989 | 8.9 high | 0.00% | no CPE yet | Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5. | Mon 26 Oct |
| CVE-2026-70185 | 8.8 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. | 14 h ago |
| CVE-2026-45369 | 8.3 high | 0.00% | no CPE yet | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3. | Mon 26 Oct |
| CVE-2026-70338 | 7.8 high | 0.00% | microsoft, powershell 7.4, powershell 7.5, powershell 7.6 | Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. | 7 h ago |
| CVE-2026-50523 | 7.8 high | 0.00% | microsoft, powershell 7.4, powershell 7.5, powershell 7.6 | Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally. | 7 h ago |
| CVE-2026-70052 | 7.8 high | 0.00% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally. | 10 h ago |
| CVE-2026-116576 | 7.8 high | 0.00% | no CPE yet | systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell expression in the command executed by util.powerShell(). The expression runs with the Node.js process account's permissions and may read or change accessible files, alter application data, or disrupt the service. The package does not expose a network service itself, so remote reachability depends on a consuming application forwarding attacker-controlled input to services() or getDynamicData(). This issue is fixed in version 5.33.16. | Mon 26 Oct |
| CVE-2026-26170 | 7.8 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-59119 | 7.3 high | 0.00% | microsoft, powershell 7.4, powershell 7.5, powershell 7.6 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. | 7 h ago |
| CVE-2026-13372 | 7.2 high | 0.00% | devolutions, remote_desktop_manager | Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. | Sun 25 Oct |
| CVE-2026-42598 | 6.9 medium | 0.00% | no CPE yet | Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers. From 2.4.0, to before 2.13.0, when requesting content from a Static Route, it was possible to request paths such as http://localhost:8080/c:/Windows/System32/drivers/etc/hosts and have the contents returned. This vulnerability is fixed in 2.13.0. | Mon 26 Oct |
| CVE-2026-107783 | 6.7 medium | 0.00% | no CPE yet | Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords. | 9 Oct |
| CVE-2026-13437 | 6.5 medium | 0.00% | devolutions, powershell_universal | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses. | Sun 25 Oct |
| CVE-2026-16798 | 6.5 medium | 0.00% | devolutions, powershell_universal | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. | Sat 24 Oct |
| CVE-2026-16802 | 6.5 medium | 0.00% | devolutions, powershell_universal | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected. | Sat 24 Oct |
| CVE-2026-0618 | 6.1 medium | 0.00% | ironmansoftware, powershell_universal | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. | Mon 26 Oct |
| CVE-2026-8694 | 5.3 medium | 0.00% | ironmansoftware, powershell_universal | Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints. | Mon 26 Oct |
| CVE-2026-16799 | 5.0 medium | 0.00% | devolutions, powershell_universal | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks. | Sat 24 Oct |
| CVE-2026-113609 | 4.8 medium | 0.00% | no CPE yet | Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them. | 20 Oct |
| CVE-2026-116627 | unscored | 0.00% | no CPE yet | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL. | Tue 27 Oct |
37 of 37
Download these 37 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.