PT-2026-76893

Name of the Vulnerable Software and Affected Versions uniget CLI affected versions not specified Description The uniget CLI contains a command injection flaw during hook editing. The application retrieves the editor path from the UNIGET EDITOR or EDITOR environment variables and uses the...

VulnCheck KEV: CVE-2025-52907

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360B20241207...

CVE-2026-75002: Improper Neutralization of Special Elements used in a Command

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection...

CVE-2026-75011: Improper Neutralization of Special Elements used in a Command

A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The proje...

PT-2026-73432

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-68518: Improper Neutralization of Special Elements used in an OS Command

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

PT-2026-76721

Name of the Vulnerable Software and Affected Versions Glances versions 4.5.2 through 4.5.5 Description An issue exists where the sanitize mustache dict function in glances/actions.py only sanitizes top-level string values, skipping nested lists and dictionaries. This allows shell operators,...

CVE-2026-19982: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument destport/destip leads to os command injection. The attack may be initiated remotely. Upgrading to versi...

PT-2026-73202

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl nas sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be...

CVE-2026-19963: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

ipTIME A3004T - Remote Code Execution

Exploit Title: ipTIME A3004T - Remote Code Execution Date: 2026-06-29 Exploit Author: Paccaron Vendor Homepage: https://www.iptime.com Software Link: https://www.iptime.com/iptime/?pageid=147&pid=34 Version: 14.19.0 Tested on: ipTIME A3004T Physical Device, OpenWRT based, MediaTek MT7621 CVE: N/A...

D-Link DNS_340L - OS Command Injection

Exploit Title: D-Link DNS340L - OS Command Injection Date: 2026-07-16 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://www.dlink.com/ Version: DNS-320 v1.00, DNS-320LW v1.01.0914.2012, DNS-325 v1.01, v1.02, DNS-340L v1.08, and possibly others Tested on: D-Link DNS-320 CVE:...

Important: pcp security update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: PCP: PCP...

CVE-2026-71472: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

ROS-20260817-73-0215

The vulnerability in Ruby is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-76719

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

PT-2026-76757

Name of the Vulnerable Software and Affected Versions kylecui NetForensicMCP version 2.1.0 Description A flaw in the execAsync function within the index.js file allows for remote command injection. This occurs when the interface/protocol argument is manipulated, enabling an attacker to execute...

PT-2026-73200

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulati...

CVE-2026-19981: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulati...

CVE-2026-71858: Improper Neutralization of Special Elements used in an OS Command

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...