EUVD-2026-77343

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-90702 D-Link DWR-M921 formDiskFormat system os command injection

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-90702

CVE-2026-90702 affects D-Link DWR-M921 firmware version 1.1.52 . The vulnerability resides in the system function within the file /boafrm/formDiskFormat , where manipulation of the partition argument leads to an OS command injection . The attack can be initiated remotely and requires high privile...

EUVD-2026-77331

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public...

CVE-2026-90693

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible...

Security update for ansible-core

This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4154-1 Security update for ansible-core

This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...

CVE-2026-90691

0x4m4 HexStrike AI is affected by a path traversal vulnerability in the FileOperationsManager function within hexstrike_server.py (component: API Files Endpoint). Manipulating the filename argument allows a remote, unauthenticated attacker to traverse file paths, with CVSS 3.1 score 8.3 (HIGH) du...

EUVD-2026-77244

A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrikeserver.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...

CVE-2026-90691 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal

A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrikeserver.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...

CVE-2026-90619

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04 ) is affected by an OS command injection in the Execute Endpoint of the file hexstrike_server.py . An unauthenticated remote attacker can manipulate the code/script argument to inject arbitrary OS commands. The proof-of-con...

EUVD-2026-77170

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

Vulnerability in Cosminexus

Overview A command argument Injection vulnerability exists in the operation management agent of Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability,...

EUVD-2026-77140

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

PT-2026-91404

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.2.2 Description An argument injection flaw exists in the ExecTool component, specifically within the ExecTool. guard command and ExecTool. spawn functions located in the nanobot/agent/tools/shell.py file. This...

PT-2026-91444

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.14 Description A flaw in the GitHub API Handler component allows remote exploitation via server-side request forgery SSRF, a technique where an attacker induces the server to make requests t...

CVE-2026-90809: Improper Neutralization of Argument Delimiters in a Command

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

PT-2026-91125

Name of the Vulnerable Software and Affected Versions D-Link DWR-M921 version 1.1.52 Description A flaw in the /boafrm/formDiskFormat file allows for remote OS command injection. This occurs through the manipulation of the partition argument within the system function. OS command injection is a...

PT-2026-91025

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A remote cross-site scripting issue exists in the /subject1.php file. This occurs when the subject argument is manipulated, allowing an attacker to execute scripts in the...

PT-2026-91117

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products handler.php of the component Product Management Module. Executing a manipulation of the argument Product Name can lead to cross site...