CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the /advanced/curl endpoint. The flaw exists because the application fails to properly sanitize user input provided to the url parameter before passing it to the underlying system curl routine. An authent...

PT-2026-83267

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web vlan membership edit dialog post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

PT-2026-82834

In openNDS before 11.0.0, the client params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83297

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

PT-2026-83271

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web poe alive rmtip post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted...

PT-2026-83279

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web login first post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web sys enablePasswd post...

PT-2026-83134

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-66323: Improper Neutralization of Parameter/Argument Delimiters

Improper neutralization of parameter/argument delimiters in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-82892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtier sample module where the system fails to validate address range parameters before they are used. This can lead to a WARN ONCE trigger if the module is enabled...

PT-2026-82879

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2026-82907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tracing/probes component where a user can easily trigger a WARN ON ONCE condition. This occurs when adding a kprobe event based on a raw address that utilizes a BT...

Linux Distros Unpatched Vulnerability : CVE-2026-80607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing/probes: Remove WARNONONCE from parsebtfarg Sashiko found that user can cause this WARNONONCE easily with adding a kprobe event based on a raw address wi...

CVE-2026-38820: Improper Neutralization of Special Elements used in an OS Command

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

Linux Distros Unpatched Vulnerability : CVE-2026-80717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its paramete...

PT-2026-83349

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description SQL injection is possible when...

Rsync DoS

The vulnerability of the Rsync file transfer and synchronization utility is related to errors in processing parameter length settings. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-83017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the sctp verify param function accepts an Adaptation Layer Indication parameter that contains only a header, despite the parameter...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...