189599 matches found
CVE-2026-94099
A command injection vulnerability exists in Netcore NBR200V2 (version 1.3.241127.071246) within the Backup Restore component. Manipulating the QUERY_STRING argument of the restore.cgi file allows remote attackers to execute arbitrary commands. A proof-of-concept exploit has been released to the p...
EUVD-2026-83810
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...
CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...
CVE-2026-94098
A command injection vulnerability exists in the Netcore NBR200V2 router (firmware 1.3.241127.071246 ), specifically in the Firmware Upgrade CGI Endpoint at /www/cgi-bin/upgrade. An attacker can remotely exploit this by manipulating the QUERY_STRING argument, achieving high impact to confidentiali...
CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...
CVE-2026-88410
The graph.UDF in FalkorDB Redis module v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application...
CVE-2026-94099: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERYSTRING results in command injection. The attack is possible to be carried o...
PT-2026-96170
Name of the Vulnerable Software and Affected Versions Email::Sender::Transport::Sendmail versions prior to 2.602 Description On Windows MSWin32, the software allows arbitrary command execution when sending a message with an envelope address that reaches the shell via the sendmail pipe function...
CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...
PT-2026-96079
Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.31.0 through 1.31.2 Description The Worker Service in Temporal Server includes a Worker Controller Instance module that registers a compute provider named subprocess. This provider allows the execution of commands on...
CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command
An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...
CVE-2026-82165: Incorrect Default Permissions
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
CVE-2026-82163: Incorrect Default Permissions
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
CVE-2026-84285: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...
CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...
CVE-2026-94098: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...
CVE-2026-77521: Improper Neutralization of Special Elements used in an OS Command
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...
CVE-2026-79916: Improper Neutralization of Special Elements used in an OS Command
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...
PT-2026-96018
Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description An issue in the Backup Restore component exists due to improper processing of the restore.cgi file. A remote attacker can achieve command injection by manipulating the QUERY STRING argumen...
CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...