azpim

Azure PIM CLI azpim A command-line interface tool for managing Azure Privileged Identity Management PIM role activations directly from your terminal. Features 🔐 Role Activation - Quickly activate eligible Azure PIM roles 🔓 Role Deactivation - Deactivate active roles when no longer needed 📋...

CVE-2026-120279

The WAVLINK WN536AX6-A router (firmware version V260507 ) is vulnerable to an OS command injection flaw in the openvpn_cli Handler. The vulnerability exists within an unknown function of the /protocol.csp file, where a remote attacker can manipulate the file_id argument to execute arbitrary comma...

CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpncli Handler. Executing a manipulation of the argument fileid can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpncli Handler. Executing a manipulation of the argument fileid can lead to os command injection. The attack can be launched remotely. The exploit has be...

EUVD-2026-114912

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpncli Handler. Executing a manipulation of the argument fileid can lead to os command injection. The attack can be launched remotely. The exploit has be...

PT-2026-135666

The VobSub subtitle decoder libsub vob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vob fill pixel that allows remote attackers to corrupt stack memory by sending a crafted SET CONTR command with...

PT-2026-135646

Attendo formerly Petpooja Payroll Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and...

CVE-2026-119737: Nexbox, Amlogic: The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes,…

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

PT-2026-135431

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global...

PT-2026-135504

Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable execlist.txt command manifest that is processed...

CVE-2026-120441: OwnTone OwnTone Server: OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows…

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

PT-2026-135807

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service...

CVE-2026-77878: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

PT-2026-135485

Control Web Panel CWP before webpanel version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS...

PT-2026-135792

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege...

Nebula AI-Powered Penetration Testing 3.0.39

Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...

CVE-2026-116958: A flaw was found in konflux-ci

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-120344: WAVLINK WN551X3-A: A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965

A vulnerability has been found in WAVLINK WN551X3-A M51X3V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument groupname leads to os command injection. The attack may be performed from remote. The...

CVE-2026-91901: Dell Alienware Command Center (AWCC): Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for…

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-Side Request Forgery...

CVE-2026-120282: WAVLINK WN536AX6-A: A vulnerability was determined in WAVLINK WN536AX6-A V260507

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function hostblack of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilize...