PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

CVE-2026-73172: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute...

CVE-2026-92580: Improper Neutralization of Special Elements used in an OS Command

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

D-Link DIR-513 Command Execution

The vulnerability of the /goform/formSysCmd function in the microprogramming software for the D-Link DIR-513 router lies in the lack of data cleaning measures at the control level when processing the sysCmd parameter. Exploiting this vulnerability allows an attacker to send arbitrary commands by...

CVE-2026-73454: Improper Neutralization of Special Elements used in a Command

On affected platforms running Arista EOS with gRPC Network Security Interface gNSI Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an...

CVE-2026-73167: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

PT-2026-93865

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API of the affected software allows an authenticated remote attacker with administrative credentials to perform command...

CVE-2026-27562: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

MiracleLinux 9 : rsync-3.2.7-1.el9_8 (AXSA:2026-1850:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1850:08 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...

CVE-2026-58146: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...

CVE-2026-91102: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-92397: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...

CVE-2026-20283: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

PT-2026-93995

Name of the Vulnerable Software and Affected Versions Cisco ThousandEyes Virtual Appliance affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform operating system command injection. This occurs because the...

PT-2026-93347

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save iodd parameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93726

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

CVE-2026-91102: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-20306: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...

CVE-2026-20305: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...