CVE-2026-42062

ELECOM wireless LAN access point devices are affected by an OS command injection in the processing of the username parameter. A crafted request can execute arbitrary OS commands with no authentication required. Affected versions are not explicitly listed in the provided documents; CVSS metrics in...

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

CVE-2026-28951

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges...

SUSE CVE-2026-7815

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields bufferusagelimit, vacuumparallel, vacuumindexcleanup, reindextablespace were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with th...

CVE-2026-28901

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

PT-2026-40772

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle MitM attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can...

The vulnerability of the fromSetWirelessRepeat() function in the Tenda AC10U router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the fromSetWirelessRepeat function in the Tenda AC10U router’s microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary co...

The vulnerability of the Cisco IOS XE operating system, which allows a perpetrator to access confidential information

The vulnerability of the Cisco IOS XE operating system is related to the transmission of critical information in plaintext. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information...

CVE-2026-45714: Improper Control of Generation of Code

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection SSTI vulnerability exists in multiple modules of CubeCart including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input using the...

Web::Passwd 操作系统命令注入漏洞

Web::Passwd is a Perl module developed by EVANK personal developers, used for managing password files and handling identity authentication in web applications. Versions of Web::Passwd prior to 0.03 contained a vulnerability related to operating system command injection. This vulnerability stemmed...

vm2 访问控制错误漏洞

vm2 is a high-level virtual machine/sandbox developed by Czech developer Patrik Simek. It runs untrusted code using built-in Node.js modules listed in the allowlist. Versions of vm2 prior to 3.11.1 had an access control vulnerability. This vulnerability arises when nesting is set to true when...

PT-2026-53696

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 Description Improper input validation in the operating system kernel allows a malicious app to pass crafted data into a privileged system or...

The vulnerability of the Ancillary Function Driver for WinSock in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Ancillary Function Driver for WinSock operating systems in Windows relates to access to resources through incompatible types. Exploiting this vulnerability can allow attackers to increase their privileges...

F5 BIG-IP 操作系统命令注入漏洞

F5 BIG-IP is an application delivery platform developed by F5 Technologies in the United States. It integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IP has a vulnerability related to operating system command injection. This...

The vulnerability of the data protection software through backup using PowerProtect Data Domain for Dell EMC Data Domain Operating Systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the data protection software through backup using PowerProtect Data Domain for Dell EMC Data Domain Operating Systems is related to improper session management. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the data protection software through backup using PowerProtect Data Domain for Dell EMC Data Domain Operating Systems allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the data protection software through PowerProtect Data Domain’s backup solution for Dell EMC Data Domain Operating Systems is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability could allow a malicious actor to execute arbitrar...

The vulnerability of the Windows Common Log File System Driver in the Windows operating system allows a hacker to gain increased privileges.

The vulnerability of the Windows Common Log File System Driver in the operating system is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The driver’s vulnerability allows for the functionality of Storage Spaces controllers on Windows operating systems, enabling attackers to increase their privileges.

The vulnerability of the driver for enabling Storage Spaces on Windows operating systems is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the TCP/IP protocol implementation in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the TCP/IP protocol implementation in Windows operating systems lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Message Queuing MSMQ queue service on Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...