EUVD-2026-88224

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-78424

Improper parameter handling in NeuVector allows for OS command injection within the privileged enforcer container, potentially leading to a complete compromise of the worker node. This vulnerability affects NeuVector versions 5.4 before 5.4.11 , 5.5 before 5.5.4 , 5.6 before 5.6.2 , and potential...

CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

patch-CVE-2026-04321

补丁：CVE-2026-04321 漏洞详情 CVE ：CVE-2026-04321 产品 ：Zyxel 防火墙 描述 ：操作系统命令注入 严重性 ：严重 补丁状态：已部署 字段| 值 ---|--- 补丁日期| 2026-01-28 状态| 已部署 部署至| 生产环境 验证人| SecOps 团队 参考资料 NVD CISA KEV...

CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit

CVE-2025-54123 — Hoverfly ミドルウェア API リモートコード実行 認証された RCE: Hoverfly ≤ 1.11.3 における OS コマンドインジェクション 脆弱性の概要 プロパティ| 値 ---|--- CVE ID| CVE-2025-54123 CVSS スコア| 9.8 — クリティカル CVSS ベクトル| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-78 OS コマンドインジェクション, CWE-20 不適切な入力検証 製品| Hoverfly — オープンソースの API...

EUVD-2026-88210

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006

A flaw in Apache Karaf 's instance-management service (InstanceServiceImpl ) allows for arbitrary OS command execution as the Karaf process user. The vulnerability exists because the service builds the launch command for a child Karaf JVM using string concatenation, splicing the caller-supplied j...

CVE-2020-24032

CVE-2020-24032 推奨説明 XoruX LPAR2RRD および STOR2RRD 2.70 仮想アプライアンス上の tz.pl では、タイムゾーン内のシェルメタ文字を介した cmd=set&tz=OS コマンドインジェクションが可能です。 脆弱性の種類: その他 OSコマンドインジェクション 製品ベンダー XoruX s.r.o. 影響を受ける製品コードベース LPAR2RRD および STOR2RRD 仮想アプライアンス バージョン - 2.70 攻撃タイプ リモート 影響: コード実行 はい ベンダーが脆弱性を確認または認識していますか？ はい 参照...

CVE-2026-86530

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2021-46422

CVE-2021-46422 韓国の無線ルーター OS コマンドインジェクション インストール git clone https://github.com/kelemaoya/CVE-2021-46422.git cd CVE-2021-46422 pip3 install -r requirements.txt 使用方法 単一URL pocsuite -r ../CVE-2021-46422.py -u url --verify 複数URL pocsuite -r ../CVE-2021-46422.py -f url.txt --verify 免責事項🧐...

CVE-2026-86530

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

EUVD-2026-88165

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-86530

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-86530

BUFFALO Wi-Fi products are vulnerable to an arbitrary OS command execution flaw due to improper handling of certain web form inputs when assembling internal command line strings. An administrative user can exploit this by sending a crafted HTTP request . No specific version numbers, root cause fi...

Vulnerability-Research

🛡️ 脆弱性研究 ここでは、私が発見した脆弱性、その弱点の詳細を含む対応するWrite-Up、およびそれらの影響と対策に関する知見を取りまとめています。 🏆 採番されたCVE CVE ID| 脆弱性タイトル| 深刻度/CVSS| 公開日| Write-Up ---|---|---|---|--- N.A.| Microsoft Security Response Center MSRC 2026年第1四半期セキュリティ研究者リーダーボード 192| N/A| Apr 2026| 公式謝辞ページ N.A.| Microsoft Online Services に対する MSRC...

CVE-2026-101009

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

CVE-2026-101007

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...