EUVD-2026-80034

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntoolsstartsetcgi, ntoolstcpdumpstartsetcgi, exedefault, and ntoolsproc components. Attackers can inject crafted arguments into these tcpdump launch routines ...

EUVD-2026-80006

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

PT-2026-93342

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached devices tab/do upload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-58146: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...

CVE-2026-27559: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93841

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 26.07.03 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with local access could exploit this...

PT-2026-93697

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412 Description An OS command injection flaw exists in the '/cgi-bin/portal.cgi' endpoint. The issue occurs because the cli cookie POST parameter is concatenated into a find command string...

CVE-2026-58147: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the httppasswdhidden and httppasswdConfirmhidden parameters, allowing an authenticated attacker to...

CVE-2026-40855: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the pingip, pingsize, and pingtimes POST parameters. The root cause is the failure to verify and sanitize...

CVE-2026-73167: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73165: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73163: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73176: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73164: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-92580: Improper Neutralization of Special Elements used in an OS Command

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-71179: Improper Neutralization of Special Elements used in an OS Command

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...

CVE-2026-92397: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...

CVE-2026-86108: Improper Neutralization of Special Elements used in an OS Command

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

CVE-2026-92398: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rgconfig/admin of the component userlistnote Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the...

CVE-2026-85756: Improper Neutralization of Special Elements used in an OS Command

SSH.NET is a Secure Shell SSH library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an...