CVE-2026-82766

CVE-2026-82766 is an OS Command Injection vulnerability in the SGA1000 product (vendor: Contec , per the referenced security advisory). An attacker who can log in to the product may execute an arbitrary OS command due to improper neutralization of special elements in an OS command. The vulnerabil...

CVE-2026-82766

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-77219

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82762

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82762

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

EUVD-2026-77217

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82762

CVE-2026-82762 is an OS command injection flaw in Contec FX5000, FX4000, and FX3000 series devices. An attacker with authenticated access (low privileges) can execute arbitrary OS commands on the device. The flaw stems from improper neutralization of special elements in OS commands. CVSS 3.1 scor...

CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

EUVD-2026-77215

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90690

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04) is vulnerable to OS command injection in the API Tools Endpoint component. The flaw resides in the subprocess.Popen call within hexstrike_server.py, where manipulation of arguments such as additional_args, target, username...

CVE-2026-90621

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-90618

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.executecommand of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be...

CVE-2026-90617

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

CVE-2026-90619

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-90621

CVE-2026-90621 is an OS command injection vulnerability in ipa-lab HackingBuddyGPT (versions up to 0.5.0 ), affecting the ssh_run_command function within src/hackingBuddyGPT/extensions/ssh_run_command.py. The attack can be launched remotely and requires low privileges , with no user interaction n...

EUVD-2026-77188

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-90619

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04 ) is affected by an OS command injection in the Execute Endpoint of the file hexstrike_server.py . An unauthenticated remote attacker can manipulate the code/script argument to inject arbitrary OS commands. The proof-of-con...