TOTOLINK A7100RU operating system command injection vulnerability

The TOTOLINK A7100RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A7100RU has a vulnerability related to operating system command injection. This vulnerability stems from a parameter in the function setAccessDeviceCfg of the CGI Handler component, located in the file...

CVE-2026-20186

A vulnerability in Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerabilit...

CVE-2026-30616

Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation result...

Cisco Identity Services Engine security vulnerabilities

Cisco Identity Services Engine is an identity services engine developed by Cisco, a US-based company. This platform collects real-time information from networks, users, and devices, and develops and implements policies to manage the network. There is a security vulnerability in Cisco Identity...

CVE-2026-30617

LangChain-ChatChat version 0.3.1 is vulnerable to Remote Code Execution (RCE) due to a flaw in its MCP STDIO server configuration and execution handling. A remote attacker can access a publicly exposed MCP management interface to configure an MCP STDIO server with arbitrary commands and arguments...

CVE-2026-30615: Improper Neutralization of Special Elements used in a Command

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic...

Sonatype Nexus Repository Manager security vulnerabilities

Sonatype Nexus Repository Manager NXRM is a repository manager developed by Sonatype, Inc., in the United States. It is primarily used for managing, storing, and distributing software. Versions of Sonatype Nexus Repository Manager from 3.0.0 to 3.70.5 have security vulnerabilities. These...

Cisco Identity Services Engine security vulnerabilities

Cisco Identity Services Engine is an identity services engine developed by Cisco, a US-based company. This platform collects real-time information from networks, users, and devices, and develops and implements policies to manage the network. There is a security vulnerability in Cisco Identity...

CVE-2026-40288

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run loads a YAML file with type: job, the...

CVE-2026-40288

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run loads a YAML file with type: job, the...

CVE-2026-40288

PraisonAI and praisonaiagents prior to versions 4.5.139 and 1.5.140 are exposed to a critical RCE via untrusted workflow YAML. When a YAML file for type: job is loaded, the JobWorkflowExecutor (job_workflow.py) processes steps allowing run (subprocess.run), script (inline Python via exec), and py...

PT-2026-40493

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю выполнить...

PT-2026-40495

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с непринятием мер по очистке данных на управляющем уровне. Эксплуатация уязвимости может позволить нарушителю,...

CVE-2026-35196: Improper Neutralization of Special Elements used in an OS Command

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the exportallcertificates action, where the course code retrieved from the session variable $SESSION'cid'...

PT-2026-40497

Уязвимость программного средства защиты данных посредством резервного копирования PowerProtect Data Domain операционных систем Dell EMC Data Domain Operating System DD OS связана с непринятием мер по нейтрализации специальных элементов. Эксплуатация уязвимости может позволить нарушителю выполнить...

Lobster extension Arbitrary Command Execution

The vulnerability of the Lobster extension for AI agents OpenClaw previously known as ClawdBot or MoltBot in Windows operating systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a hacker to execute arbitrary commands...

OpenClaw Synchronization Command Execution

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows a hacker to execute arbitrary commands...

Totolink A7100RU Router setNtpCfg Arbitrary Command Execution

The vulnerability of the setNtpCfg function /cgi-bin/cstecgi.cgi in the Totolink A7100RU router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the tz parameter. Exploiting this vulnerability allows...

Freefloat FTP Server Command Execution

The vulnerability of the NOOP Command Handler component in the Freefloat FTP Server lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the webbrowser.open function. An attacker can execute arbitrary commands by supplying a specially crafted URL containing %action that is processed by the API. Note: This issue is due to incomplete fix fo...