The vulnerability of the setNtpCfg function (/cgi-bin/cstecgi.cgi) in the Totolink A7100RU router’s microprogramming software allows a hacker to bypass existing security restrictions and execute arbitrary commands.

The vulnerability of the setNtpCfg function /cgi-bin/cstecgi.cgi in the Totolink A7100RU router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the tz parameter. Exploiting this vulnerability allows...

The vulnerability of the NOOP Command Handler component of the Freefloat FTP Server allows a hacker to execute arbitrary commands.

The vulnerability of the NOOP Command Handler component in the Freefloat FTP Server lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-40497

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю выполнить...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the webbrowser.open function. An attacker can execute arbitrary commands by supplying a specially crafted URL containing %action that is processed by the API. Note: This issue is due to incomplete fix fo...

CVE-2026-28291

A flaw was found in simple-git, a JavaScript library for running native Git commands. An attacker could exploit this vulnerability by manipulating Git options, bypassing existing safety checks. This incomplete fix for a previous vulnerability allows for the execution of arbitrary commands, leadin...

CVE-2026-28291

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and --upload-pack. The flaw stems from an incomplete fix for...

USN-8171-1 vim vulnerabilities

Nathan Mills discovered that Vim could crash when parsing certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10 CVE-2026-32249 It was discovered that Vim did not properly sanitize user input...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) relates to synchronization errors when using a shared resource, allowing a hacker to execute arbitrary commands.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows a hacker to execute arbitrary commands...

The vulnerability of the setVpnPassCfg() function in the cstecgi.cgi script of the TOTOLINK A7100RU router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the setVpnPassCfg function in the cstecgi.cgi script of the TOTOLINK A7100RU router’s software is related to the failure to eliminate special elements during the processing of the pptpPassThru parameter. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability in the src/daemon/schtasks.ts script of the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a perpetrator to execute arbitrary commands.

The vulnerability in the src/daemon/schtasks.ts script of the AI agent OpenClaw previously known as ClawdBot or MoltBot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

The vulnerability in the src/daemon/schtasks.ts script of the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a perpetrator to execute arbitrary commands.

The vulnerability in the src/daemon/schtasks.ts script of the AI agent OpenClaw previously known as ClawdBot or MoltBot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) in Windows operating systems arises from the failure to take measures to neutralize special elements. This vulnerability allows a perpetrator to execute arbitrary commands.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot in Windows operating systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a hacker to execute arbitrary commands...

The vulnerability in the extensions/lobster/src/lobster-tool.ts script of the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a violator to execute arbitrary commands.

The vulnerability in the extensions/lobster/src/lobster-tool.ts script of the AI agent OpenClaw previously known as ClawdBot or MoltBot relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

TOTOLINK A7100RU operating system command injection vulnerability (CNVD-2026-32922)

The TOTOLINK A7100RU is a wireless router produced by TOTOLINK, a Chinese electronics company. The TOTOLINK A7100RU has a vulnerability related to operating system command injection. This vulnerability stems from the setDiagnosisCfg function in the /cgi-bin/cstecgi.cgi file, which fails to proper...

The vulnerability of the tools.exec.safeBins configuration in the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a violator to execute arbitrary commands.

The vulnerability of the tools.exec.safeBins configuration in the AI agent OpenClaw previously known as ClawdBot or MoltBot is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

GHSA-VC46-VW85-3WVM PraisonAI has critical RCE via `type: job` workflow YAML

praisonai workflow run loads untrusted YAML and if type: job executes steps through JobWorkflowExecutor in jobworkflow.py. This supports: - run: → shell command execution via subprocess.run - script: → inline Python execution via exec - python: → arbitrary Python script execution A malicious YAML...

TRENDnet TEW-713RE Command Injection Vulnerability

The TRENDnet TEW-713RE is a wireless network range extender from TRENDnet. The TRENDnet TEW-713RE suffers from a command injection vulnerability that originates from a misuse of the parameter dest in the file /goform/addRouting, which can be exploited by an attacker to cause arbitrary command...

CVE-2026-32892: Improper Neutralization of Special Elements used in an OS Command

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move function in fileManage.lib.php passes user-controlled path values directly into exec shell commands without using...

The vulnerability of the ESAFENET DSM software for monitoring and managing network security, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the ESAFENET DSM monitoring and network security management software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow attackers to execute arbitrary commands...

The vulnerability in the web interface of the operating system PAN-OS allows a hacker to bypass security restrictions and execute arbitrary commands.

The vulnerability of the PAN-OS operating system’s web management interface is related to the lack of measures taken to neutralize the script in the web page attributes. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary commands...