CVE-2026-75486 Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

EUVD-2026-67789

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

CVE-2026-75486

Synk Sweater Comb (Snyk) before 3.8.8 contains a command injection vulnerability. The root cause is in the expectGitBranch() function in src/lint.ts, which passes an unsanitized branch name—sourced from the linters..optic-ci.original field in the .vervet.yaml configuration file—directly into chil...

CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

EUVD-2026-67783

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-75123

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization, allowing a remote attacker...

CVE-2026-75123 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

EUVD-2026-67782

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote...

CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75122 PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75122

PLANET GS-4210-16P2S firmware before 3.441b260626 is affected by an authenticated OS command injection in /cgi-bin/httpuploadcert.cgi . The certificate password field in a certificate upload request is passed to a shell command without sanitization of shell metacharacters, allowing a remote attac...

CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-75121

PLANET GS-4210-16P2S managed switches with firmware prior to 3.441b260626 are affected by an authenticated OS command injection in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter directly into a shell command without sanitizatio...

CVE-2026-75121 PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

EUVD-2026-67781

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share...

Conti-Ransomware-DFIR-Investigation

Conti Ransomware — DFIR Investigation ProxyShell Exploitation...

Security update for apptainer

This update for apptainer fixes the following issue: CVE-2026-17106: github.com/moby/go-archive: tar extraction routines do not confine filesystem operations to the destination directory and allow for arbitrary file writes bsc1275248. Patch Instructions: To install this SUSE update use the SUSE...

Exploit for Eval Injection in Langflow

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Ov...

Security update for python

This update for python fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...