EUVD-2026-105328

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2026-10138

A critical OS command injection vulnerability exists in the boa formUpload() functionality of the TOTOLINK X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ). The vulnerability stems from a lack of sanitization on the devicemac input parameters provided via HTTP POST requests. An a...

CVE-2026-10138

A OS command injection vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

EUVD-2026-105325

A OS command injection vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

GHSA-587H-7WMJ-H5PM launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

CVE-2026-113802

Wavlink WL-WN530BE1-A firmware through M30BE1V251117 contains an OS command injection vulnerability in the sub23B54 function of the ioos binary, which passes the unsanitized fileid parameter of /protocol.csp?opt=ovpnfile requests with type=del to popen. A remote unauthenticated attacker can send ...

CVE-2026-113506

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out...

CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler

Wavlink WL-WN530BE1-A firmware through M30BE1V251117 contains an OS command injection vulnerability in the sub23B54 function of the ioos binary, which passes the unsanitized fileid parameter of /protocol.csp?opt=ovpnfile requests with type=del to popen. A remote unauthenticated attacker can send ...

CVE-2026-113802

The Wavlink WL-WN530BE1-A router, running firmware through M30BE1_V251117 , is vulnerable to an OS command injection vulnerability within the sub_23B54 function of the ioos binary. The flaw occurs because the file_id parameter from /protocol.csp?opt=ovpn_file requests with type=del is passed unsa...

EUVD-2026-105226

Wavlink WL-WN530BE1-A firmware through M30BE1V251117 contains an OS command injection vulnerability in the sub23B54 function of the ioos binary, which passes the unsanitized fileid parameter of /protocol.csp?opt=ovpnfile requests with type=del to popen. A remote unauthenticated attacker can send ...

CVE-2026-113506

The aaPanel software (up to version 8.25.0 ) is vulnerable to an OS command injection flaw within the File Manager component. The issue resides in the ExecShell function of the class/public/common.py file, where the lack of proper sanitization of the sfile/dfile/access/user arguments allows for r...

EUVD-2026-105212

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out...

CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injection

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out...

CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-112942

The launch-editor Node.js package is vulnerable to a validation bypass on Windows prior to version 2.14.2 . The launch-editor-middleware component fails to correctly validate file paths because it resolves paths while a line-and-column suffix is present, but removes that suffix before performing ...

CVE-2026-112942 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-112942 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

EUVD-2026-105035

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-113390

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of th...