CVE-2026-27558: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93262

Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...

PT-2026-93343

A low-privileged remote attacker can exploit a command injection vulnerability in the Field Shadow Password class using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

CVE-2026-91102: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-20176: Improper Neutralization of Special Elements used in a Command

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to...

CVE-2026-73164: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

D-Link DIR-513 Command Execution

The vulnerability of the /goform/formSysCmd function in the microprogramming software for the D-Link DIR-513 router lies in the lack of data cleaning measures at the control level when processing the sysCmd parameter. Exploiting this vulnerability allows an attacker to send arbitrary commands by...

CVE-2026-58146: Improper Neutralization of Special Elements used in an OS Command

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...

PT-2026-93865

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API of the affected software allows an authenticated remote attacker with administrative credentials to perform command...

MiracleLinux 9 : rsync-3.2.7-1.el9_8 (AXSA:2026-1850:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1850:08 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...

CVE-2026-92397: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...

CVE-2026-20283: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

PT-2026-93726

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

CVE-2026-91102: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-20306: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...

CVE-2026-20305: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...

CVE-2026-27561: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27554: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...