CVE-2026-55743Critical· 9.6▾ MidnightThe shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61438High· 7.3PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
CVE-2026-106556High· 7.7Backstage is an open framework for building developer portals
CVE-2026-33396Critical· 9.9OneUptime is an open-source monitoring and observability platform
CVE-2026-102829Critical· 9.2simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
CVE-2026-102828Critical· 9.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
CVE-2026-87911Critical· 9.6An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a s…