CVE-2026-72718: Improper Control of Generation of Code

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

EUVD-2026-54829

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and...

CVE-2026-71991

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet...

CVE-2026-71991

Affected product: MSI Radix AXE6600 router (firmware v781521). Vulnerability: Command injection in the TelnetSSH function used for Telnet configuration, enabling remote command execution on the device. Impact: Attacker can run arbitrary commands with root privileges via the Telnet configuration i...

CVE-2026-71991

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet...

CVE-2026-71989 MSI Radix AXE6600 v781521 Command Injection via porTrigger function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious command...

CVE-2026-71987

CVE-2026-71987 affects MSI Radix AXE6600 firmware v781521. A command injection flaw exists in the alg function that allows remote attackers to execute arbitrary commands with root privileges on the device. The vulnerability is exploitable over the network with low attack complexity and no authent...

CVE-2026-71985

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands with root privileges on the underlying system. Affected product: MSI Radix AXE6600 (firmware v781521). Vulnerable c...

CVE-2026-71984 MSI Radix AXE6600 v781521 Command Injection via urlfilter

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root...

Reverse ICMP Listener

Receives ICMP Echo Request packets from pythonreverseicmp agents. Requires scapy and CAPNETRAW / Administrator. Sends commands via ICMP Echo Reply payloads CMD:, PING, EXIT. !/usr/bin/env python3 -- coding: utf-8 -- """ICMP covert reverse shell listener pairs with pythonreverseicmp payload."""...

CVE-2026-71957

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71957 D-Link DWR-M961 Buffer Overflow via app.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

EUVD-2026-54809

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

EUVD-2026-54808

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

CVE-2026-71956

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

CVE-2026-71955 D-Link DWR-M961 Command Injection via /boafrm/formWsc

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resultin...

EUVD-2026-54805

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

EUVD-2026-54797

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...