Incomplete List of Disallowed Inputs

Incomplete Input Validation in GlideExpression Script

• Без аутентификации

servicenow · servicenow10 июл. 2024 г.

Apache Kylin: Command injection by Useless configuration

• RCE
• Инъекция команд

apache · kylin30 дек. 2022 г.

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica

• Без аутентификации
• Десериализация

fasterxml · jackson-databind6 февр. 2018 г.

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because

• pre-auth RCE
• Десериализация

fasterxml · jackson-databind26 февр. 2018 г.

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user

• Без аутентификации
• Десериализация

fasterxml · jackson-databind6 февр. 2018 г.

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklistin

• pre-auth RCE

antfin · sofa-hessian27 февр. 2019 г.

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network add

• Без аутентификации
• SSRF

private address check project · private address check16 нояб. 2017 г.

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

• pre-auth RCE

google cloud · agent development kit (adk) for python9 сент. 2026 г.

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted argumen

• pre-auth RCE

mistralai · mistral-vibe11 сент. 2026 г.

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

• pre-auth RCE

jetbrains · teamcity6 окт. 2026 г.

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha

• RCE

monstra · monstra29 янв. 2018 г.

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax.

• Без аутентификации

safemode project · safemode21 июл. 2017 г.

An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff.

• pre-auth RCE

wwbn · avideo24 июл. 2025 г.

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

• RCE

mervinpraison · praisonai21 июл. 2026 г.

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of dis

nvidia · openshell25 авг. 2026 г.

PraisonAI codeMode sandbox escape via Function constructor

mervinpraison · praisonai15 сент. 2026 г.

Privilege Escalation in Bookreen

• Без аутентификации

bookreen · bookreen5 сент. 2023 г.

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently aut

• pre-auth RCE
• Обход пути

langflow · langflow17 июл. 2026 г.

Privilege escalation in NetHack

• Без аутентификации

nethack · nethack10 мар. 2020 г.

Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass

• Без аутентификации

PyPI · picklescan17 июн. 2026 г.

Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs

• Без аутентификации

PyPI · picklescan17 июн. 2026 г.

Duplicate Advisory: Picklescan does not block ctypes

• Без аутентификации

PyPI · picklescan17 июн. 2026 г.

Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist

• pre-auth RCE

PyPI · picklescan23 июн. 2026 г.

Xerte Online Toolkits File Upload RCE via elfinder Connector

• pre-auth RCE
• Обход аутентификации
• Обход пути

thexerteproject · xerteonlinetoolkits22 апр. 2026 г.

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

• pre-auth RCE

flowiseai · flowise4 авг. 2026 г.