CVE-2026-17402

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to OS command injection . The root cause is that user-supplied input is not properly neutralized before being passed to the operating system. This vulnerability could allow a remote authenticated att...

Viessmann Vitogate 300 - Remote Code Execution

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...

Jpom 2.10.0-2.11.12 - Authentication Bypass

Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection. id: CVE-2026-120201 info: name:...

DATAGERRY - REST API Auth Bypass

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. id: CVE-2024-46627 info: name: DATAGERRY - REST API Auth Bypass author: gy741 severity: critical description: | Incorrect access control in BECN DATAGERRY v2.2 allows attackers...

Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. id: CVE-2020-35713 info: name: Belkin Linksys RE6500 1.0.012.001 - Remote Command Execution author: gy741 severity:...

SolarView 6.00 - Remote Command Execution

SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. id: CVE-2022-40881 info: name: SolarView 6.00 - Remote Command Execution author: For3stCo1d severity: critical description: | SolarView Compact 6.00 is vulnerable to a command injection via networktest.php. impact: |...

TurboMeeting - Post-Authentication Command Injection

The Certificate Signing Request CSR feature in the admin portal of the application is vulnerable to command injection. This vulnerability could allow authenticated admin users to execute arbitrary commands on the underlying server by injecting malicious input into the CSR generation process. The...

Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution

An authenticated user can register an MCP stdio server command that executes when Langflow lists server actions. The 1.9.0 REST validation can be bypassed by placing arguments in the command field. This probe runs a short Python callback, verifies an out-of-band DNS lookup, and removes its server...

Moodle - Remote Code Execution

Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system. id: CVE-2024-43425 info: name: Moodle - Remote Code Execution author:...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-117530

A flaw was found in JetBrains Junie CLI. Incomplete validation of allowlisted commands allows a local attacker to bypass execution restrictions and run arbitrary commands on the system. Successful exploitation can enable an attacker to compromise sensitive data, alter system settings, or disrupt...

CVE-2026-82033

A flaw was found in DeepSeek Harness. A missing authentication check in its Remote Procedure Call RPC control plane allows an unauthorized local attacker to access internal session interfaces. By interacting with these unauthenticated endpoints, an attacker can bypass human approval safeguards,...

CVE-2026-123022

A flaw was found in AgentScope. A remote attacker can exploit this command injection vulnerability by submitting manipulated command parameters to the Model Context Protocol MCP Workspace API. Because input is passed directly to system execution functions without adequate validation, an attacker...

CVE-2026-82910

A flaw was found in Apache OFBiz. A server-side template injection vulnerability in the MacroScreenRenderer component allows an authenticated remote attacker with basic view permissions to execute arbitrary commands. This issue occurs because the application incorporates unescaped link parameter...

CVE-2025-70521

A flaw was found in the Fanvil x7a diagnostic ping tool. The device management portal fails to properly validate user-supplied input. An unauthenticated remote attacker can exploit this issue to execute arbitrary commands and run malicious code within the underlying operating system. Mitigation...

EUVD-2026-117469

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz...

ZeroShell <= 1.0beta11 Remote Code Execution

ZeroShell 1.0beta11 and earlier via cgi-bin/kerbynet allows remote attackers to execute arbitrary commands through shell metacharacters in the type parameter in a NoAuthREQ x509List action. id: CVE-2009-0545 info: name: ZeroShell = 1.0beta11 Remote Code Execution author: geeknik severity: critica...

CVE-2026-76506

A vulnerability in the Cisco UCS Central Software web-based management interface allows an authenticated, remote attacker to achieve remote code execution or perform information disclosure . The root cause is insufficient validation of user-supplied input in an HTTP request. A successful exploit ...

CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-77690

ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target...