EUVD-2026-64632

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

M3200-OpenUI

Inseego M3200 Root Exploit A single-file exploit that takes t...

PT-2026-95899

Name of the Vulnerable Software and Affected Versions D-Link R95 BE9500 version 1.00.16 Description An OS command injection flaw exists in the DHMAPI component of the device. The issue occurs when the NTPServer argument is processed by the system function within the /bin/ssi file. Because the inp...

CVE-2026-78063: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

PT-2026-79758

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

PT-2026-79783

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-78141: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

Exploit for CVE-2026-75616

CVE-2026-75616 Authenticated OS command injection in the TP-L...

Exploit for CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command inject...

Exploit for CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injec...

Exploit for CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via ru...

CVE-2026-57998

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

CVE-2026-57998 better-npm-audit OS Command Injection via registry flag

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

CVE-2026-57998 better-npm-audit OS Command Injection via registry flag

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

CVE-2026-57998

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

CVE-2026-57998 better-npm-audit OS Command Injection via registry flag

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

EUVD-2026-64261

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec in index.ts, which...

CVE-2026-57998

better-npm-audit (npm package) through 3.11.0 and the 4.0.0-rc.2 prerelease is vulnerable to OS command injection via the --registry option. The user-supplied registry value is interpolated into a command string in src/handlers/handleInput.ts without validation or quoting, then passed to child_pr...

CVE-2026-77988

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvramget of the component CLI Configuration Tool. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the publ...

CVE-2026-77988 TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvramget of the component CLI Configuration Tool. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the publ...