EUVD-2026-53867

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19034

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19034

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

EUVD-2026-53844

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-19022

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

CVE-2026-19022

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

CVE-2026-19022 OpenHands send_pull_request.py initialize_repo command injection

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

CVE-2026-19022

OpenHands (up to v0.62.0) contains a vulnerable element in the function initialize_repo within OpenHands/resolver/send_pull_request.py, enabling command injection. Remote exploitation is indicated. The vendor reportedly deleted the original GitHub issue report, and the affected path/file appears ...

CVE-2026-19022 OpenHands send_pull_request.py initialize_repo command injection

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

EUVD-2026-53834

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

CVE-2026-18997

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-71311

A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed CRLF characters can be injected...

CVE-2026-71312

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows a remote attacker to execute arbitrary commands on the server when processing SFTP paths. By crafting a malicious filename that uses specific Unicode single-quote characters, an attacker can bypass...

CVE-2026-18996

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

CVE-2026-18997

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...