CVE-2026-55378: Improper Neutralization of Special Elements used in an OS Command

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface . An authenticated attacker can execute arbitrary operating system commands with elevated privileges, potentially leading to unauthorized access to sensitive information or complete device compromise ...

CVE-2026-78037 Xiiaozet LK100W OS Command Injection

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-78037 Xiiaozet LK100W OS Command Injection

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

EUVD-2026-67311

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

EUVD-2026-67136

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2026-57499 Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE)

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2026-81562

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562

CVE-2026-81562 is an OS command injection vulnerability in AlexGladkov claude-in-mobile version 3.10.2 , affecting the execSync function in the file src/adb/client.ts . A local attacker with low privileges can manipulate input to inject operating system commands, leading to partial compromise of ...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

vulnerabilities in Adobe Campaign Classic

Adobe has identified several vulnerabilities in Adobe Campaign Classic. These vulnerabilities involve Server-Side Request Forgery SSRF and OS Command Injection. The SSRF vulnerability allows attackers to manipulate requests on the server, which can lead to the execution of arbitrary code without...

CVE-2026-81097: Improper Neutralization of Special Elements used in an OS Command

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

CVE-2026-57499: Improper Input Validation

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2026-26899: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-81562: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...