PT-2026-21645

Name of the Vulnerable Software and Affected Versions Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.7C0 Description A post-authentication command injection exists in the TR-369 certificate download CGI program. An authenticated attacker with administrator privileges could execute...

MindsDB 路径遍历漏洞

MindsDB is a joint query engine developed by MindsDB Inc., designed specifically for AI agents and large language models. It can handle questions related to PB-level enterprise data. Versions of MindsDB prior to 25.9.1.1 had a path traversal vulnerability. This vulnerability stemmed from the...

CVE-2025-13943: Improper Neutralization of Special Elements used in an OS Command

A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50ABVY.7C0 could allow an authenticated attacker to execute operating system OS commands on an affected device...

PT-2026-21644

Name of the Vulnerable Software and Affected Versions Zyxel EX3301-T0 firmware versions through 5.50ABVY.7C0 Description A post-authentication command injection issue exists in the log file download function. This could allow an authenticated attacker to execute operating system OS commands on an...

CVE-2025-14577: Missing Authentication for Critical Function

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/sessionajax.php endpoint. This issue was fixed in version 1.24.0190 Slican NCP and 6.61.0010 Slica...

Binardat 10G08-0800GSM 操作系统命令注入漏洞

Binardat 10G08-0800GSM is a high-performance switch from the Chinese company Binardat. The firmware version V300SP10260209 and earlier of the Binardat 10G08-0800GSM network switch has a vulnerability related to operating system command injection. This vulnerability stems from command injection...

The vulnerability of the SkyBridge BASIC MB-A130 router’s microprogramming system, related to the failure to implement measures to neutralize special elements, allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the SkyBridge BASIC MB-A130 router’s microprogramming system lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

CVE-2025-70329

TOTOLink X5000R v9.1.0cu2415B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 and other vlanVidLanX parameters are retrieved via UciGetStr and passed to the CsteSystem function without adequate validation or...

AZL-78317 CVE-2025-67733 affecting package valkey for versions less than 8.0.7-1

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same...

MAL-2026-1041 Malicious code in secure-monkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86cd85a74e391ecd4f01e0ca9a2f8db368edc52021d175bb01a957669f2301ba The package secure-monkey was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in secure-monkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86cd85a74e391ecd4f01e0ca9a2f8db368edc52021d175bb01a957669f2301ba The package secure-monkey was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-70328

TOTOLINK X6000R v9.4.0cu.1498B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The hosttime parameter is retrieved via sub40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the...

TOTOLINK X6000R 安全漏洞

The TOTOLINK X6000R is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK X6000R v9.4.0cu.1498B20250826 version contains a security vulnerability. This vulnerability stems from improper cleanup of the hosttime parameter in the NTPSyncWithHost handler, which may allow...

MAL-2026-994 Malicious code in vl-ui-code-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf0716d5a814e3cd0ca1da245819d81f5238adb1911513d88b36825c7a99be The package vl-ui-code-preview was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in vl-ui-code-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf0716d5a814e3cd0ca1da245819d81f5238adb1911513d88b36825c7a99be The package vl-ui-code-preview was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in vl-ui-contact-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a26177e2527de2d73ffbdd96d1ebe7113d3a9745726b1aa8fc4537813caa889 The package vl-ui-contact-card was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-995 Malicious code in vl-ui-contact-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a26177e2527de2d73ffbdd96d1ebe7113d3a9745726b1aa8fc4537813caa889 The package vl-ui-contact-card was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in vl-ui-action-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 681eef2c6f7a9061c23f448a351fbf64b8d5302e6343f486e534c4a440b1e793 The package vl-ui-action-group was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-988 Malicious code in vl-ui-action-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 681eef2c6f7a9061c23f448a351fbf64b8d5302e6343f486e534c4a440b1e793 The package vl-ui-action-group was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-992 Malicious code in vl-ui-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e34ef0af8a8e8cc96afd0941b0fe2a5259eb4d2cf73564c5dde8b97a2bdf766 The package vl-ui-button was found to contain malicious code. Source: ossf-package-analysis...