CVE-2026-118477

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.

• CWE-78

• https://advisories.orangecyberdefense.com/advisories/166

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11841An attacker may perform unauthenticated read and write opera…9.4
• CVE-2026-118435Out-of-bounds write vulnerability in Samsung Open Source esc…5.4
• CVE-2026-11844The iVEC-IEI Virtualization Edge Computer developed by IEI I…4.9
• CVE-2026-11845The iVEC-IEI Virtualization Edge Computer developed by IEI I…7.2
• CVE-2026-11846The  iVEC-IEI Virtualization Edge Computer developed by IEI …8.1
• CVE-2026-11847The  iVEC-IEI Virtualization Edge Computer developed by IEI…4.3
• CVE-2026-11848The iRM-IEI Remote Management developed by IEI Integration C…5.3
• CVE-2026-118485Axel Download Accelerator 2.17.14 and earlier performs URL p…8.1
• CVE-2026-11849The  iRM-IEI Remote Management developed by IEI Integration …9.8
• CVE-2026-1185A configuration file on the local file system had improper i…8.8
• CVE-2026-11850An integer underflow vulnerability was found in MIT krb5 in …5
• CVE-2026-11851Improper Neutralization of Special Elements used in an SQL C…5.9