osctrl vulnerabilities

2 known vulnerabilities in osctrl from Jmpsec. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  osctrl: Improper Neutralization of Input During Web Page Generation

  CVE-2026-28280Feb 26, 2026Jmpsec

  osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter w

• 8.4 High severity

  osctrl: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-28279Feb 26, 2026Jmpsec

  osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when c