CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

SUSE SLES12 Security Update : emacs (SUSE-SU-2026:3993-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3993-1 advisory. - code execution upon opening arbitrary file bsc1275941. - CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader bsc1276264....

Linux Distros Unpatched Vulnerability : CVE-2026-92745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat...

EulerOS Virtualization 2.10.0 : samba (EulerOS-SA-2026-3888)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configure...

RHEL 8 : dracut (RHSA-2026:69119)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69119 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

CVE-2026-82412: Improper Neutralization of Special Elements used in an OS Command

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

EulerOS Virtualization 2.10.1 : samba (EulerOS-SA-2026-3854)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configure...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

MariaDB wsrep_notify_cmd Command Execution

The vulnerability of the wsrepnotifyCmd function in the MariaDB database management system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

vm2 Command-Line Interface Code Execution

The vulnerability of the command-line interface of the NPM package manager’s vm2 library is related to initialization errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

MariaDB SST Command Execution

The vulnerability of the State Snapshot Transfer SST mechanism of the MariaDB database management system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R Router Command Execution

The vulnerability of the setSmartQosCfg function in TOTOLINK A3300R router microprogramming systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-96038

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology Feiyu Star Router version B-MB5E202-210322-r11656 Description An issue exists in the Cookie Handler component where improper handling of the session id variable in the '/send order.cgi' endpoint allows for remote...

PT-2026-96199

Name of the Vulnerable Software and Affected Versions Dell Command Powershell Provider DCPP versions prior to 2.10.2 Description An issue exists where sensitive information is inserted into log files. A low privileged attacker with local access could exploit this to achieve information disclosure...

PT-2026-96300

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user with AI feature access can execute dangerous statements or database functions because the runQuery function in server/modules/ai/orchestrator/tools/runQuery.js uses an...

ROS-20260921-73-0073

The vulnerability in the incus is related to the insertion or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-55071: Improper Control of Generation of Code

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-94099: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERYSTRING results in command injection. The attack is possible to be carried o...

CVE-2026-94098: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-94097: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...