CVE-2026-71915: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input...

CVE-2026-16348: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

PT-2026-79818

Name of the Vulnerable Software and Affected Versions 4MOSAn GCB Doctor affected versions not specified Description An OS Command Injection issue exists where unauthenticated remote attackers can execute arbitrary system commands on the server. This is possible through a parameter in an unremoved...

CVE-2026-71910: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71907: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

CVE-2026-71906: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-80952

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the webBackupAction function. The flaw stems from insufficient filtering of the option, key, pw encode, pathN, and valueN fields before they ar...

PT-2026-80964

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the setTime function. The flaw stems from insufficient filtering of the username and password variables before they are used in command...

CVE-2026-71928: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu...

PT-2026-80962

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the fdftDevice function. The flaw stems from insufficient filtering of the username and password fields before they are used in command...

PT-2026-80942

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the mesh start speed test function. The flaw stems from insufficient sanitization of the meshdevice index and meshdevice ip variables before they a...

CVE-2026-71931: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftpupgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71921: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to...

CVE-2026-71923: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the authset function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-81012

Name of the Vulnerable Software and Affected Versions mcp-ffmpeg-helper versions 0.1.0 through 0.2.1 Description An OS command injection issue exists within the Tool Handler component, specifically in the handleToolCall function located in the src/tools/handlers.ts file. This occurs when the form...

PT-2026-80943

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the InquierTime function. The flaw stems from insufficient filtering of the time field before it is used in command execution. A remote attacker wi...

PT-2026-80981

Name of the Vulnerable Software and Affected Versions AzuraCast affected versions not specified Description An improper permission check in the profile editing process allows users with only profile permissions to modify Liquidsoap custom configuration fields. The endpoint 'PUT /api/station/stati...

CVE-2026-71916: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger th...

CVE-2026-71943: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...

CVE-2026-59561: Improper Neutralization of Special Elements used in an OS Command

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal"...