CVE-2026-57499: Improper Input Validation

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2026-35869

The LB-link Router AC450M V4.0.0 is affected by a Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library. The root cause is the insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. ...

CVE-2026-26899

The luci-app-https-dns-proxy component in OpenWrt PR #15 (prior to 2026-01-17) is vulnerable to arbitrary command execution. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to properly neutralize shell metacharacters in the name parameter, allowing authenticated users t...

Security update for pcp (moderate)

openSUSE security update: security update for pcp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21636-1 Rating: moderate References: bsc1272922 bsc1272923 bsc1272924 bsc1272925 bsc1272926 bsc1272927 bsc1272928 bsc1272930 Cross-References:...

PT-2026-82517

Name of the Vulnerable Software and Affected Versions luci-app-https-dns-proxy versions prior to 2026-01-17 Description Authenticated users can execute arbitrary shell commands due to improper handling of shell metacharacters in the name parameter within the setInitAction function located in...

PT-2026-82658

A Command Injection vulnerability exists in the bs SetLimitCli info function within the libshare.so library of LB-link Router AC2100 AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context...

PT-2026-82489

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

RockyLinux 10 : ruby (RLSA-2026:50778)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50778 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Escargot 4.3.0-214-gfaee4437 Command Injection

An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...

RockyLinux 9 : ruby:3.3 (RLSA-2026:50828)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50828 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

PT-2026-82543

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ip address parameter is embedded...

CVE-2026-35869

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-35869: Improper Input Validation

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-81562: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

PT-2026-84464

Name of the Vulnerable Software and Affected Versions Composer versions 1.0 through 2.2.29 Composer versions 2.10.0 through 2.10.2 Description Composer, a dependency manager for PHP, fails to validate the source.url when source.type is set to perforce. A malicious package from a custom repository...

RockyLinux 10 : ruby4.0 (RLSA-2026:50773)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50773 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

TencentOS Server 3: dracut (TSSA-2026:0902)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0902 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...