Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 07:10:25 +0000 bdu:2026-07861 https://cve.radiocsirt.org/vuln/bdu:2026-07861 bdu:2026-07861 https://cve.radiocsirt.org/vuln/bdu:2026-07861 EUVD-2026-337049 https://cve.radiocsirt.org/vuln/euvd-2026-337049 EUVD-2026-337049 https://cve.radiocsirt.org/vuln/euvd-2026-337049 fkie_cve-2026-6942 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6942 <p>radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.</p> <p>radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6942 GHSA-g65f-grqm-9jg5 https://cve.radiocsirt.org/vuln/ghsa-g65f-grqm-9jg5 <p>radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.</p> <p>radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.</p> https://cve.radiocsirt.org/vuln/ghsa-g65f-grqm-9jg5