CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. In versions 1.2.1-beta.1 through 1.3.1-beta.2 , the PR Branch Checker workflow in .github/workflows/pr_checker.yml interpolates untrusted values (github.head_ref and github.event.pull_request.head.repo.full_name) directly into a shell gh pr comm...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75122

PLANET GS-4210-16P2S firmware before 3.441b260626 is affected by an authenticated OS command injection in /cgi-bin/httpuploadcert.cgi . The certificate password field in a certificate upload request is passed to a shell command without sanitization of shell metacharacters, allowing a remote attac...

CVE-2025-32463

Exploit CVE-2025-32463 Panoramica Questo repository fornisce un tool di exploit basato su Go per CVE-2025-32463 , una vulnerabilità critica di escalation dei privilegi locali CVSS 9.3 nelle versioni di sudo 1.9.14 fino a 1.9.17. Consente a utenti locali non autorizzati di ottenere accesso root...

MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2025-30156

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

EUVD-2026-67360

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

EUVD-2026-67767

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the advanced/curl endpoint. The url parameter is not adequately sanitized before being passed to the system's curl execution routine. An authenticated attacker can bypass space restrictions using shell va...

PT-2026-83134

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

PT-2026-83114

Name of the Vulnerable Software and Affected Versions Plesk for Linux versions 18.0.34 through 18.0.79.8 Description A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to...

CVE-2026-35868

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...