CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

EUVD-2026-64963

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

CVE-2026-71904

DrayTek VigorAP multiple models are affected by an OS command injection in the tr069TestInform function. The root cause is insufficient filtering of dangerous characters before the event_code field is concatenated into a system command, allowing a remote attacker with valid administrative credent...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

Exploit for Command Injection in Apache Ranger

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS comma...

Emacs TRAMP command injection vulnerability

The emacs TRAMP environment has a command injection vulnerability. This vulnerability arises from TRAMP incorrectly cleaning up login parameters before passing them to the local shell, which may lead to arbitrary code execution...

Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...

CVE-2026-76055

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE-SU-2026:23254-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

CVE-2026-65612

A flaw was found in nnn. An attacker can exploit this vulnerability by placing a file with a specially crafted name, containing shell syntax, on a shared filesystem, removable media, or within an extracted archive. If a victim then navigates to and opens this file using the preview-tabbed feature...

CVE-2026-65611

A flaw was found in nnn, a file manager. This vulnerability, known as Shell Command Injection, allows an attacker to execute arbitrary commands. By creating a specially crafted directory name containing shell syntax on a shared filesystem, removable media, or within an extracted archive, an...

tplink-archer-root-exploit

TP-Link Archer AX73 / AX10 — Root Shell Exploit Auto-Mail L...

CVE-2026-76055

CVE-2026-76055 is an OS command injection in the package manager component of Black Duck blackduck-c-cpp prior to version 3.0.7. Filesystem paths encountered while traversing a scanned build directory are interpolated into shell command strings without quoting or escaping , allowing shell metacha...

EUVD-2026-64896

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...

CVE-2026-76055

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...