PT-2026-82659

A Command Injection vulnerability exists in the bs SetLimitCli info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-26899: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-35868: Improper Input Validation

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC2100AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-26899

The luci-app-https-dns-proxy component in OpenWrt PR #15 (prior to 2026-01-17) is vulnerable to arbitrary command execution. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to properly neutralize shell metacharacters in the name parameter, allowing authenticated users t...

EUVD-2026-67254

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An...

CVE-2026-57499: Improper Input Validation

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-35869

The LB-link Router AC450M V4.0.0 is affected by a Command Injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library. The root cause is the insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. ...

PT-2026-82487

Name of the Vulnerable Software and Affected Versions Zbtlink WE1326 firmware 19.1101 Zbtlink WE357 firmware 19.1101 Zbtlink WE5926 firmware 19.1101 Zbtlink WE5926-WD firmware 19.1101 Zbtlink WE826-Q firmware 19.1101 Zbtlink WE826-T2 firmware 19.1101 Zbtlink WE826-WD firmware 19.1101 Zbtlink WG10...

Zimbra Collaboration Suite 10.1.19 SMTP Command Injection

Zimbra Collaboration Suite versions prior to 10.1.20 contain an OS command injection vulnerability in the optional zimbra-snmp package when SNMP notifications are enabled. This exploit injects a crafted service status message through an unauthenticated SMTP recipient address, causing the SNMP...

CVE-2026-74233: Use of Hard-coded Cryptographic Key

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain...

VulnCheck KEV: CVE-2026-74233

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain...

CVE-2026-81097: Improper Neutralization of Special Elements used in an OS Command

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1667:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1667:01 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

RockyLinux 8 : ruby:3.3 (RLSA-2026:50728)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50728 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

RockyLinux 9 : ruby:4.0 (RLSA-2026:50827)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50827 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Security update for pcp (moderate)

openSUSE security update: security update for pcp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21636-1 Rating: moderate References: bsc1272922 bsc1272923 bsc1272924 bsc1272925 bsc1272926 bsc1272927 bsc1272928 bsc1272930 Cross-References:...

PT-2026-82658

A Command Injection vulnerability exists in the bs SetLimitCli info function within the libshare.so library of LB-link Router AC2100 AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

Escargot 4.3.0-214-gfaee4437 Command Injection

An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...