Monthly
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Auto-approval command filtering in Roo Code through 3.54.0 can be bypassed, letting an attacker run commands that should have required explicit user approval. The flaw lives in parseCommandLine(), which drops command substitutions written next to '*' or '?' glob tokens, so a payload such as 'echo *$(...)' is checked against the allowlist as though it were only the benign prefix 'echo'. Exploitation is conditionally gated and requires two things to line up: the auto-approval/command-allowlist feature must be enabled, and the attacker must land an indirect prompt injection in content the agent reads (source files, repository data, issues, or web content); version 3.54.0's CVSS 4.0 base score is 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P), and our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:R with high confidentiality, integrity, and availability impact once those conditions are met. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the referenced public technical writeup documents the bypass pattern in detail.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Server-side remote code execution affects Handlebars versions 4.0.0 through releases prior to 4.7.10, where a flaw in the lookupProperty prototype-access check lets a rendered template reach Function.prototype.constructor and obtain the JavaScript Function constructor, executing attacker-supplied code with the server application's privileges. Exploitation is conditional: an unauthenticated remote attacker must be able to render a template whose source they control, the runtime must have allowProtoMethodsByDefault enabled (not the default configuration), and the template context must expose an accessible function value that can be traversed via __proto__. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 4.7.10.
Hydra 1.3.4 through 1.3.5 and the 1.4.0.dev line prior to 1.4.0.dev9 can execute attacker-chosen code when an application runs Hydra's instantiate() on configuration an attacker can influence, because the callable blacklist added for CVE-2026-68508 is name-based and can be sidestepped via wrappers, aliases, dispatch helpers, or deferred invocation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) indicates no attacker privileges are required but a victim application must actually instantiate untrusted or externally sourced config, which is why user interaction is scored; the flaw is CWE-184 (Incomplete List of Disallowed Inputs) and is best understood as an incomplete fix rather than a new class of bug. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and vendor-released patches exist in Hydra 1.3.6 and 1.4.0.dev9. Applications that only ever instantiate developer-authored, trusted configuration are not exposed, and the vendor explicitly documents the blocklist as a best-effort defense-in-depth stopgap rather than a security boundary.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Auto-approval command filtering in Roo Code through 3.54.0 can be bypassed, letting an attacker run commands that should have required explicit user approval. The flaw lives in parseCommandLine(), which drops command substitutions written next to '*' or '?' glob tokens, so a payload such as 'echo *$(...)' is checked against the allowlist as though it were only the benign prefix 'echo'. Exploitation is conditionally gated and requires two things to line up: the auto-approval/command-allowlist feature must be enabled, and the attacker must land an indirect prompt injection in content the agent reads (source files, repository data, issues, or web content); version 3.54.0's CVSS 4.0 base score is 7.7 (AV:N/AC:L/AT:P/PR:N/UI:P), and our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:R with high confidentiality, integrity, and availability impact once those conditions are met. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the referenced public technical writeup documents the bypass pattern in detail.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Server-side remote code execution affects Handlebars versions 4.0.0 through releases prior to 4.7.10, where a flaw in the lookupProperty prototype-access check lets a rendered template reach Function.prototype.constructor and obtain the JavaScript Function constructor, executing attacker-supplied code with the server application's privileges. Exploitation is conditional: an unauthenticated remote attacker must be able to render a template whose source they control, the runtime must have allowProtoMethodsByDefault enabled (not the default configuration), and the template context must expose an accessible function value that can be traversed via __proto__. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 4.7.10.
Hydra 1.3.4 through 1.3.5 and the 1.4.0.dev line prior to 1.4.0.dev9 can execute attacker-chosen code when an application runs Hydra's instantiate() on configuration an attacker can influence, because the callable blacklist added for CVE-2026-68508 is name-based and can be sidestepped via wrappers, aliases, dispatch helpers, or deferred invocation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) indicates no attacker privileges are required but a victim application must actually instantiate untrusted or externally sourced config, which is why user interaction is scored; the flaw is CWE-184 (Incomplete List of Disallowed Inputs) and is best understood as an incomplete fix rather than a new class of bug. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and vendor-released patches exist in Hydra 1.3.6 and 1.4.0.dev9. Applications that only ever instantiate developer-authored, trusted configuration are not exposed, and the vendor explicitly documents the blocklist as a best-effort defense-in-depth stopgap rather than a security boundary.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings.