CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

EUVD-2026-58755

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-5233 vulnerabilities

Vulnerabilities for packages: cg...

GO-2025-3953 vulnerabilities

Vulnerabilities for packages: temporal...

GO-2026-4857 vulnerabilities

Vulnerabilities for packages: grafana...

GO-2025-3845 vulnerabilities

Vulnerabilities for packages: gatus...

CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

EUVD-2026-58564

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

CVE-2026-19771 affects Baicells EG3661M with LuCI Web Interface (file /cgi-bin/luci). The vulnerability arises from manipulating the arguments MaxHops/Timeout/Size, enabling OS command injection. AttackVector is NETWORK with LOW complexity and none user interaction required; authenticated context...

CVE-2026-17186: Improper Neutralization of Special Elements used in an OS Command

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command...

CVE-2026-19635: Improper Neutralization of Special Elements used in an OS Command

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

PT-2026-72088

Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...

PT-2026-71949

Name of the Vulnerable Software and Affected Versions Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA Description An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the MaxHops, Timeout, or Size arguments within the...

SAP NetWeaver OS Command Injection (3745182)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an OS command injection vulnerability as referenced in SAP Security Note 3745182: - SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls...

PT-2026-76577

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description OS command injection is possible in the smart user tool. An MCP client can execute arbitrary shell commands with the privileges of the user running the server by providing a crafted...

PT-2026-72121

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...