EUVD-2026-55621

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-13206

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-72589

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72573

An OS command injection vulnerability in 4xmen/pm2panel all versions allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec'pm2 restart ' + id without input...

CVE-2026-72580

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-28672

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8...

CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55217

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-72589

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

EUVD-2026-55226

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

CVE-2026-72580

The CVE-2026-72580 entry details an OS command injection in the duhow/xiaoai-patch for Xiaomi smart speakers running the patch. The vulnerability arises because the /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without san...

EUVD-2026-55227

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72579

NASA HyperCP (main branch) contains an OS command injection vulnerability exploitable by a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov. The Source/OBPGSession.py handler parses server response headers without sanitization and forwards attacker-c...

CVE-2026-72579 NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72577

NASA fprime-gds (through version 3.4.3) contains multiple vulnerabilities that collectively allow unauthenticated remote code execution on the ground station host and the ability to inject commands into connected spacecraft. The Flask application (src/fprime_gds/flask/app.py) applies no authentic...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...