CVE-2026-44461: Improper Neutralization of Special Elements used in an OS Command

Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key for example via project termin...

OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username

A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the '%' character in...

EUVD-2026-32615

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username

A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the '%' character in...

The vulnerability of the Zabbix IT-infrastructure monitoring system lies in its inability to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary commands.

The vulnerability of the Zabbix IT-infrastructure monitoring system is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the virtual learning environment Moodle, related to the lack of measures to neutralize special elements, allows a violator to execute arbitrary commands.

The vulnerability of the virtual training environment Moodle is related to the lack of measures taken to neutralize special elements within it. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the Zabbix IT-infrastructure monitoring system, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Zabbix IT-infrastructure monitoring system is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the network infrastructure for Flannel containers, related to the lack of measures taken at the management level to clean data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Flannel container’s network infrastructure is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the formConnectionSetting() function in the /goform/formConnectionSetting file of the Edimax BR-6675nD router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the formConnectionSetting function in the /goform/formConnectionSetting file of the Edimax BR-6675nD router’s microprogramming software is related to the lack of data cleaning measures at the control level when processing the maxConn and timeOut parameters. Exploiting this...

The vulnerability of the formWlanMP() function in the /goform/formWlanM file of the Edimax BR-6428NS router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the formWlanMP function in the /goform/formWlanM microprogramming system for Edimax BR-6428NS routers is related to the lack of data cleaning measures at the management level when processing parameters such as ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID,...

The vulnerability of the formWizSurvey() function in the /goform/formWizSurvey file of the webs component of the microprogramming software for wireless signal amplifiers, Edimax EW-7438RPn, allows a hacker to execute arbitrary commands.

The vulnerability of the formWizSurvey function in the /goform/formWizSurvey file of the webs component of the microprogramming software for wireless signal amplifiers, such as Edimax EW-7438RPn, is related to the lack of measures taken to neutralize special elements used in the operating system’...

The vulnerability of the formWlanMP function in the /goform/formWlanMP file of the webs component of the Edimax EW-7438RPn wireless signal amplifiers’ microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the formWlanMP function in the /goform/formWlanMP file of the webs component of the Edimax EW-7438RPn wireless signal amplifiers’ microprogramming system is related to the lack of measures to neutralize certain parameters during the processing of ateFunc, ateGain, ateTxCount,...

Command Injection

Overview miniclawd is an A lightweight personal AI assistant with multi-channel support Affected versions of this package are vulnerable to Command Injection via the ExecTool.execute function in the /src/tools/exec.ts file. An attacker can execute arbitrary operating system commands by supplying...

CVE-2026-9455 Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. Remote exploitation of the...

EUVD-2026-31628

A weakness has been identified in Edimax EW-7438RPn 1.31. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component Content-Type Handler. Executing a manipulation of the argument...

ROS-20260524-73-0028

Vulnerability in vim related to failure to take measures to neutralize special elements used in operating system commands. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary commands...

The vulnerability of the secure_popen() function in the Glances monitoring tool allows a hacker to execute arbitrary commands.

The vulnerability of the securepopen function in the Glances monitoring tool is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Edimax BR-6675nD 命令注入漏洞

The Edimax BR-6675nD is a dual-band broadband wireless router produced by Edimax Corporation. Version 1.12 of the Edimax BR-6675nD contains a command injection vulnerability. This vulnerability stems from the formUSBStorage function in the POST Request Handler component, specifically the...

Security update for cockpit (important)

openSUSE Security Update: Security update for cockpit Announcement ID: openSUSE-SU-2026:0176-1 Rating: important References: 1265040 Cross-References: CVE-2026-4802 CVSS scores: CVE-2026-4802 SUSE: 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE...

SUSE-SU-2026:21785-1 Security update for cockpit

This update for cockpit fixes the following issues - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040. - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory...