PT-2026-96232

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2 Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-94097: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

PT-2026-96038

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology Feiyu Star Router version B-MB5E202-210322-r11656 Description An issue exists in the Cookie Handler component where improper handling of the session id variable in the '/send order.cgi' endpoint allows for remote...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

PT-2026-96199

Name of the Vulnerable Software and Affected Versions Dell Command Powershell Provider DCPP versions prior to 2.10.2 Description An issue exists where sensitive information is inserted into log files. A low privileged attacker with local access could exploit this to achieve information disclosure...

CVE-2026-49810: Insertion of Sensitive Information into Log File

Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

PT-2026-96037

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 Description A remote command injection flaw exists in the /send order.cgi endpoint. The issue occurs when the mac argument is manipulated, allowing an attacker to execute...

PT-2026-96201

Name of the Vulnerable Software and Affected Versions Dell Command | Intel vPro Out of Band versions prior to 4.7.2 Description Incorrect default permissions allow a low privileged attacker with local access to potentially cause information disclosure. Recommendations Update Dell Command | Intel...

CVE-2026-88410: Missing Authentication for Critical Function

The graph.UDF in FalkorDB Redis module v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application...

CVE-2026-55897: Improper Neutralization of Special Elements used in an OS Command

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

EUVD-2026-84188

The graph.UDF in FalkorDB Redis module v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application...

PT-2026-96257

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Assistants utilizing a tool, MCP tool, skill, or sub-application use the SandboxShellBackend, which exposes an execute shell tool. Because the execute function is omitted from the interrupt on...

PT-2026-104829

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to scan.lua and scripts/lua/rest/v2/exec/host/schedule vulnerability scan.lua accept the scan ports parameter without an administrator gate and pass it...

CVE-2026-88410

The graph.UDF in FalkorDB Redis module v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application...

CVE-2026-94095: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/networktools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be...

CVE-2026-94139: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

VulnCheck KEV: CVE-2026-7273

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...