PT-2026-80963

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the setDevProto function. The flaw stems from insufficient filtering of the username and password variables before they are used in command...

CVE-2026-71929: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to...

PT-2026-80960

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the setDevice function. The flaw stems from insufficient sanitization of the username, password, and location fields before they are used in...

PT-2026-80939

Name of the Vulnerable Software and Affected Versions Volmarg Personal Management System affected versions not specified DrayTek VigorAP affected versions not specified Description Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET...

PT-2026-80958

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-80985

Name of the Vulnerable Software and Affected Versions Archer BE800 V1 affected versions not specified Archer BE3600 V1 affected versions not specified Archer AX75 V1 affected versions not specified Description An unauthenticated OS command injection exists in the parental control functionality...

PT-2026-80979

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

PT-2026-80993

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

PT-2026-80940

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the setLan function. The flaw stems from insufficient validation of the lanIp and lanNetmask variables before they are used in command execution. A...

PT-2026-80951

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the pingtrace function due to insufficient validation of the host field before command execution. A remote attacker with valid administrative...

CVE-2026-71926: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted...

PT-2026-80947

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the 'upload settings.cgi' interface. The flaw occurs due to insufficient filtering of the restorekey field before it is concatenated into a shell...

CVE-2026-78177: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-71924: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

PT-2026-80957

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the auth set function. The flaw stems from insufficient filtering of the username and password fields before they are used in command execution...

CVE-2026-78211: Improper Neutralization of Special Elements used in an OS Command

4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server...

CVE-2026-71917: Improper Neutralization of Special Elements used in an OS Command

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

PT-2026-80955

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A pre-authentication command injection issue exists in the 'setget.cgi' interface. The flaw stems from insufficient filtering of the pass field before command execution, allowing ...

CVE-2026-78541: Improper Neutralization of Special Elements used in an OS Command

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-76055: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...