CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

EUVD-2026-86584

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-97863 misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Values

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

CVE-2026-97863

The cisco_firesight_manager_ACL_rule_export module in misp-modules is vulnerable to Shell Command Injection . The module generates a .sh script by interpolating configuration and MISP attribute values (such as destination IPs and URLs) into single-quoted shell strings without proper escaping. An ...

CVE-2026-32604

CVE-2026-32604 - Spinnaker GitRepo 아티팩트 RCE CVE-2026-32604 - git/repo 아티팩트 유형을 통한 Spinnaker의 원격 코드 실행. 이것은 Spinnaker의 GitRepo 아티팩트 처리에서 발생하는 명령 주입 / 원격 코드 실행 취약점입니다. 취약한 기능은 git/repo 아티팩트의 version 필드를 통해 사용자가 제어하는 값이 적절히 정제되지 않은 채 명령 실행에 도달할 수 있도록 합니다. 취약한 엔드포인트는 다음과 같습니다: PUT /artifacts/fetch 중요...

EUVD-2026-86482

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85542: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...

EUVD-2025-211003

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2026-100368: Improper Neutralization of Special Elements used in an OS Command

CliInvoke is a .NET library for invoking command-line programs, and its CliInvoke.Specializations packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. CliInvoke.Specializations versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4,...

CVE-2025-51457: Improper Neutralization of Special Elements used in a Command

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2026-97863: Improper Neutralization of Special Elements used in an OS Command

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

PT-2026-98859

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated attacker can exploit a command injection flaw in the GIM bundle import functionality. By providing a specially crafted GIM bundle, an attacker can pass controlled arguments...

PT-2026-99126

Name of the Vulnerable Software and Affected Versions Mediawiki - ExternalData Extension versions prior to 3.7 Description An OS Command Injection issue exists in the ExternalData extension, which allows unauthenticated remote code execution through wikitext. This occurs due to the improper...

CVE-2026-100382: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...