CVE-2026-75364

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

CVE-2026-80427: Improper Neutralization of Argument Delimiters in a Command

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...

CVE-2026-77540: Improper Input Validation

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges . The vulnerability occurs because the content parameter is directly concatenated to the ProcessBuilder , providing a vector for unauthorized privilege escalation. No specific exploit details, impact assessments, or remedia...

CVE-2026-75364

The Comfast CF-N1-S (firmware 2.6.0.1) and CF-WR630AX (2024-01-30 build) are vulnerable to OS command injection due to a lack of input sanitization in the update_interface_png SET handler within /usr/bin/webmgnt. Specifically, the display_name parameter is concatenated via sprintf() into an unquo...

PT-2026-82054

Name of the Vulnerable Software and Affected Versions UniFi Network Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and high privileges to perform command injection on an adopted device. Command injection is a...

SSHFS Arbitrary Command Execution

The vulnerability of the findbasepath function in the SSHFS file system lies in the ability to exploit or modify arguments. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

CVE-2026-70419: Improper Neutralization of Special Elements used in an OS Command

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-68861: Improper Neutralization of Special Elements used in an OS Command

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-80214: Improper Neutralization of Special Elements used in an OS Command

LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server...

PT-2026-82058

Name of the Vulnerable Software and Affected Versions UniFi OS Server affected versions not specified Description An Improper Input Validation issue allows a malicious actor with network access and high privileges to perform Command Injection on the host device. Command Injection is a flaw that...

CVE-2026-77539: Improper Input Validation

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...

CVE-2020-15874

A command injection vulnerability exists in LibreNMS 1.65 . A remote authenticated attacker with normal privileges can exploit this flaw in the /graph.php API endpoint to execute arbitrary shell commands . Remediation is available in version 1.65.1 .

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104833 advisory. A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets...

MiracleLinux 9 : pcp-6.3.7-8.el9_8.4 (AXSA:2026-1662:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1662:02 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets...

PT-2026-82071

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and low privileges to perform command injection on the host device. Command injection is a fl...

PT-2026-82075

Name of the Vulnerable Software and Affected Versions UniFi Enterprise Audio/Video Bridge affected versions not specified Description An improper input validation issue allows a network-based actor to perform command injection on the device. Command injection is a flaw where an attacker can execu...

PT-2026-82046

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host for Linux versions prior to 15.81.5 Description A command injection issue exists that allows a remote attacker to execute arbitrary commands with the privileges of the current user. This occurs when a user click...

PT-2026-82254

Name of the Vulnerable Software and Affected Versions Dell PowerProtect One versions 20.1.0.0 and earlier Description An improper neutralization of special elements used in an OS command allows a low privileged attacker with remote access to perform OS Command Injection, which can lead to remote...