GO-2026-6248 uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli

uniget CLI has an EDITOR Command Injection in gitlab.com/uniget-org/cli...

GO-2026-6145 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in github.com/OliveTin/OliveTin...

CVE-2026-24301

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-60762

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

pcp security update

An update is available for pcp. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Performance Co-Pilot PCP is a suite of tools, services, and libraries for...

RLSA-2026:55617 Important: pcp security update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: PCP: PCP...

RUSTSEC-2026-0271 FTP command injection via CRLF in control channel arguments

Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...

FTP command injection via CRLF in control channel arguments

Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...

D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect

Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

ipTIME EAD UDP Service Detection (56026)

Detects ipTIME routers exposing the EAD UDP service on port 56026. On affected firmware e.g. A3004T 14.19.0, this endpoint is reachable without authentication and is associated with pre-auth command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ipTIME EAD UDP service port 56026...

D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)

CVE-2024-10914: unauthenticated OS command injection in /cgi-bin/accountmgr.cgi cmd=cgiuseradd. The name parameter is concatenated into system without sanitisation. Affects EOL models including DNS-320, DNS-320LW, DNS-325, and DNS-340L. Command output is returned in the HTTP response. Opens an...

SUSE-SU-2026:23191-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...

CVE-2026-70430 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-70428 vulnerabilities

Vulnerabilities for packages: jenkins...

RLSA-2026:55740 Important: pcp security update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: PCP: PCP...

pcp security update

An update is available for pcp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Performance Co-Pilot PCP is a suite of tools, services, and libraries for...

CVE-2026-75094

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...