spotweb vulnerabilities

Products

• spotweb/spotweb 1

Latest spotweb CVEs

Newest publication first

1. CVE-2026-108546 Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

   Published 2026-10-10

   High·CVSS 7.7

   Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.