CVE-2026-71171: Improper Neutralization of Special Elements used in an OS Command

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...

CVE-2026-77547: Improper Input Validation

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

CVE-2026-77543: Improper Input Validation

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

EUVD-2026-66744

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

CVE-2026-75364: Improper Neutralization of Special Elements used in an OS Command

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

PT-2026-82052

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and low privileges to perform command injection on the host device. Command injection is a fl...

PT-2026-81923

Name of the Vulnerable Software and Affected Versions LibreNMS affected versions not specified Description The Virtualization Discovery module contains a command line injection flaw. This allows an authenticated administrator to execute arbitrary code on the host server. Recommendations At the...

Tenable Security Center SCAP Audit File Command Injection

This is a Metasploit module that demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. This module requires Metasploit: https://metasploit.com/download Current...

PT-2026-82213

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied...

PT-2026-82085

Name of the Vulnerable Software and Affected Versions UniFi Talk Application versions prior to 5.3.2 Description An improper input validation flaw allows a malicious actor with network access to execute a command injection on the host device. This issue enables the execution of operating system...

CVE-2026-77535: Improper Input Validation

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

CVE-2026-80138

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-79912

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntpserver results in command injection. The attack can be initiated remotely. The exploit is now...

CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntpserver results in command injection. The attack can be initiated remotely. The exploit is now...

CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntpserver results in command injection. The attack can be initiated remotely. The exploit is now...

CVE-2026-79912

TOTOLINK N600R (firmware 4.3.0cu.7647_B20210106) is affected by a command injection in the getCurrentTime function of /cgi-bin/cstecgi.cgi. An unauthenticated remote attacker can manipulate the ntp_server argument to inject and execute arbitrary commands. A public proof-of-concept exploit is avai...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-80138

ClipBucket V5 (versions 5.5.1 through 5.5.3-#153) is affected by an OS command injection in its web installer. The php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution, allowing an unauthenticated attacker to submit a crafted POST request and exec...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...