Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

Exploit Title: Linksys E12002.0.04 - Unauthenticated OS Command Injection Date: 2026-07-22 Exploit Author: JarrettgxzSec Vendor Homepage: www.linksys.com Version: FW " printf"! Example: python3 sys.argv0 192.168.1.100 192.168.1.1 8080" sys.exit1 ATTACKERIP = sys.argv1 TARGETIP = sys.argv2...

Important: vim

Issue Overview: Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in...

CVE-2026-82971: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

PT-2026-84054

Name of the Vulnerable Software and Affected Versions QVidium Opera11 version 3.3.2a26-Ax4x-opera11 Description An unauthenticated command injection issue exists in the CGI Script component. A remote attacker can exploit this by manipulating the ipaddr argument within the '/cgi-bin/net tr.cgi'...

PT-2026-83791

Name of the Vulnerable Software and Affected Versions D-Link DNS-320L versions prior to 20260717 D-Link DNS-327L versions prior to 20260717 D-Link DNS-340L versions prior to 20260717 D-Link DNS-345 versions prior to 20260717 Description A remote OS command injection exists within the CGI Handler...

PT-2026-83779

Name of the Vulnerable Software and Affected Versions D-Link DNS-340L version 1.01B04 D-Link DNS-340L version 1.03B06 D-Link DNS-340L version 1.04.B02 D-Link DNS-340L version 1.05b04 D-Link DNS-345 version 1.01B04 D-Link DNS-345 version 1.03B06 D-Link DNS-345 version 1.04.B02 D-Link DNS-345 versi...

CVE-2026-82690: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/vemgr.cgi. This manipulation of the argument fdev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-82689: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomountmgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can b...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

PT-2026-83849

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-59111: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

CVE-2026-82702: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component aspWlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-83998

Name of the Vulnerable Software and Affected Versions MetaGPT version 0.8.1 Description An OS command injection flaw exists where the rebuild class views function in metagpt/repo parser.py interpolates the path argument into a shell command using shell=True without using an argument list. This...

CVE-2026-79408

MetaGPT version 0.8.1 is vulnerable to an OS command injection flaw within the metagpt/repo_parser.py file. The root cause is that the RepoParser.rebuild_class_views() function interpolates the path argument into a shell command using shell=True without utilizing an argument list. This allows an ...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

Important: dracut

Issue Overview: A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent...

RHEL 8 : dracut (RHSA-2026:61252)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61252 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

CVE-2026-82668: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...