TOTOLINK A3300R Router Command Execution

The vulnerability of the setSmartQosCfg function in TOTOLINK A3300R router microprogramming systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R SetLanCfg Command Execution

The vulnerability of the setLanCfg function in TOTOLINK A3300R router microprogramming systems lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R Router Command Execution

The vulnerability of the setUPnPCfg function in TOTOLINK A3300R router microprogramming systems is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R SetVpnPassCfg Command Execution

The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

MariaDB SST Command Execution

The vulnerability of the State Snapshot Transfer SST mechanism of the MariaDB database management system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

MariaDB wsrep_sst_receive_address Command Execution

The vulnerability of the wsrepsstreceiveaddress and wsrepsstdonor parameters in the sql/wsrepsst.cc file of the MariaDB database management system is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability may allow an attacker operating remotely...

MariaDB wsrep_notify_cmd Command Execution

The vulnerability of the wsrepnotifyCmd function in the MariaDB database management system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Incus uploadDir S3 Arbitrary Command Execution

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

PT-2026-96300

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user with AI feature access can execute dangerous statements or database functions because the runQuery function in server/modules/ai/orchestrator/tools/runQuery.js uses an...

CVE-2026-49811: Incorrect Permission Assignment for Critical Resource

Dell Command | Monitor DCM, versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

PT-2026-96199

Name of the Vulnerable Software and Affected Versions Dell Command Powershell Provider DCPP versions prior to 2.10.2 Description An issue exists where sensitive information is inserted into log files. A low privileged attacker with local access could exploit this to achieve information disclosure...

PT-2026-96087

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.3 through 17.5 Description An OS Command Injection flaw allows an attacker to execute arbitrary commands on the server. OS Command Injection is a flaw where an application passes unsafe user-supplied data ...

PT-2026-96151

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717 Description An issue exists where the endpoints 'scripts/lua/rest/v2/add/host/to scan.lua' and 'scripts/lua/rest/v2/exec/host/schedule vulnerability scan.lua' accept the scan ports parameter without requirin...

CVE-2026-82412: Improper Neutralization of Special Elements used in an OS Command

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

RHEL 8 : dracut (RHSA-2026:69119)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69119 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

SUSE SLES15 Security Update : dracut (SUSE-SU-2026:3997-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3997-1 advisory. Update to version 059+suse.730.g73d3411aa. - CVE-2026-6893: improper handling and escaping of DHCP options can lead to command...

PT-2026-96221

Name of the Vulnerable Software and Affected Versions Dell Command | Integration Suite for System Center versions prior to 6.7.2 Description Incorrect default permissions allow a low privileged attacker with local access to potentially cause information disclosure. Recommendations Update to versi...

PT-2026-96232

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2 Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

VulnCheck KEV: CVE-2026-7273

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...