CVE-2026-31162

The ToToLink A3300R wireless router is vulnerable to a command injection flaw in its firmware version v17.0.0cu.557_B20221024 . The vulnerability exists in the ttlWay parameter of the /cgi-bin/cstecgi.cgi endpoint, where an attacker can execute arbitrary commands by sending malicious data. While ...

CVE-2026-31166

The ToToLink A3300R wireless router is vulnerable to a command injection vulnerability in the v17.0.0cu.557_B20221024 firmware. The root cause is the cstecgi.cgi file failing to properly validate the hour parameter, which allows an attacker to execute arbitrary commands. While the documents confi...

PT-2026-34677

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557 B20221024 allowing attackers to execute arbitrary commands via the stun-port parameter to /cgi-bin/cstecgi.cgi...

PT-2026-34715

Name of the Vulnerable Software and Affected Versions ToToLink A3300R version 17.0.0cu.557 B20221024 Description An issue allows attackers to execute arbitrary commands via the recHour parameter sent to the '/cgi-bin/cstecgi.cgi' endpoint. Recommendations At the moment, there is no information...

CVE-2026-31178

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31162

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31173: Improper Neutralization of Special Elements used in a Command

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-31165: Improper Neutralization of Special Elements used in a Command

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi...

CVE-2026-41247: Improper Neutralization of Special Elements used in an OS Command

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

CVE-2026-31167

The ToToLink A3300R wireless router (firmware v17.0.0cu.557_B20221024 ) is vulnerable to a command injection flaw. The root cause is the failure to properly filter the mode parameter in the /cgi-bin/cstecgi.cgi endpoint. An attacker can exploit this lack of sanitization to execute arbitrary comma...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2026-014266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014266 advisory. Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens ...

CVE-2026-31174

The ToToLink A3300R wireless router is vulnerable to a command injection flaw in its v17.0.0cu.557_B20221024 firmware. The root cause is the cstecgi.cgi file failing to properly validate the informEnable parameter. An attacker can exploit this lack of sanitization to execute arbitrary commands vi...

CVE-2026-40517 radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's printgvars function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitiz...

CVE-2026-41167

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via "POST...

CVE-2026-26354

Dell PowerProtect Data Domain with Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer Overflow vulnerability. An unauthenticated attacker...

PT-2026-34585

IBM Total Storage Service Console TSSC / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

Vim zip.vim Command Execution

The vulnerability in the zip.vim plugin for Vim text editors is related to improper validation of the path name for directories with restricted access. Exploitation of this vulnerability may allow an attacker to execute arbitrary commands...

Vim Command Injection

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-38834

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the dopingaction function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2026-38834: Improper Neutralization of Special Elements used in a Command

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the dopingaction function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...