CVE-2026-86108 Security Advisory 0181

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

EUVD-2026-80038

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSsetcgi.c and related ddnsProc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments...

EUVD-2026-80034

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntoolsstartsetcgi, ntoolstcpdumpstartsetcgi, exedefault, and ntoolsproc components. Attackers can inject crafted arguments into these tcpdump launch routines ...

EUVD-2026-80006

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

PT-2026-93855

A vulnerability was found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate...

PT-2026-93262

Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...

CVE-2026-20350: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

PT-2026-93722

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description The edgserver management service contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a...

PT-2026-93693

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description The portal.cgi component contains two security issues. First, an authentication bypass exists because the session verification mechanism improperly validates the session...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93351

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection...

CVE-2026-40855: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the pingip, pingsize, and pingtimes POST parameters. The root cause is the failure to verify and sanitize...

PT-2026-93347

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save iodd parameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-73172: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute...

PT-2026-93864

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the diagnostic tools allows an authenticated remote attacker with administrative credentials to perform command injection on the...

PT-2026-93726

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

CVE-2026-92397: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...

CVE-2026-27548: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-71179: Improper Neutralization of Special Elements used in an OS Command

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...