Collabora Online Built-in CODE Server Before 26.4.303 OS Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303 contain an unauthenticated OS command injection vulnerability in proxy.php that can result in remote code execution when the CODE server is not running...

CVE-2026-120276: WAVLINK WN536AX6-A: A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0

A weakness has been identified in WAVLINK WN536AX6-A V2605072.0.0. This vulnerability affects the function sub416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument groupname causes os command injection. It is possible to initiate the attack...

CVE-2026-114364: Apache Software Foundation Apache Syncope: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

AGCRE Regular Expression Library 20261020

AGCRE is a BSD-licensed regular expression library written in C that implements pattern compilation and matching using a Pike Virtual Machine architecture. It supports POSIX regular expressions, Perl-style escapes, lazy matching, non-capturing groups, backreferences, Unicode escapes, UTF-8, and...

CVE-2026-120441: OwnTone OwnTone Server: OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows…

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

PT-2026-135062

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard cli group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group id/group name leads to os command injection. The attack may be initiated...

PT-2026-135436

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-120282: WAVLINK WN536AX6-A: A vulnerability was determined in WAVLINK WN536AX6-A V260507

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function hostblack of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilize...

PT-2026-135332

Name of the Vulnerable Software and Affected Versions WAVLINK WN551X3-A version M51X3 V251020-WO-182e965 Description An OS command injection flaw exists in the WireGuard CLI Group Handler component within the /bin/ioos file. A remote attacker can exploit this by manipulating the group name argume...

PT-2026-135491

Control Web Panel CWP before webpanel version 1.16 contains an OS command injection vulnerability in the protected directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers ca...

CVE-2026-74993: Starnet Computer and Network Systems Inventory Tracking Application: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer…

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

PT-2026-135410

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-120280: WAVLINK WN536AX6-A: A vulnerability has been found in WAVLINK WN536AX6-A V260507

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguardcligroup handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument groupid/groupname leads to os command injection. The attack may be initiated remotely...

PT-2026-135457

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd sticker find in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

PT-2026-135667

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-73697: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection…

Control Web Panel CWP before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpinieditor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands...

PT-2026-135502

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

CVE-2026-16306: INFINITT Healthcare System Manager: Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

Google Chrome Microsoft Edge Sandbox Bypass

The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to insufficient input validation. Exploitation of this vulnerability may allow an attacker to bypass sandbox protections by using a specially crafted AppleScript command...

Tenda F451 Router Command Execution

The vulnerability in the formWriteFacMac function of the Web Management Interface within the Tenda F451 router software relates to improper handling of special elements. Exploitation of this vulnerability may enable a remote attacker to execute arbitrary commands...