PT-2026-96017

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description Command injection is possible via remote manipulation of the QUERY STRING argument within the Firmware Upgrade CGI Endpoint. This issue occurs in the /www/cgi-bin/upgrade endpoint...

CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-55897: Improper Neutralization of Special Elements used in an OS Command

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

CVE-2026-77521: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...

CVE-2026-62371: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

CVE-2026-79916: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-94139: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

CVE-2026-94098: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-94095: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/networktools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be...

CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

PT-2026-96018

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description An issue in the Backup Restore component exists due to improper processing of the restore.cgi file. A remote attacker can achieve command injection by manipulating the QUERY STRING argumen...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-94097: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

PT-2026-96087

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.3 through 17.5 Description An OS Command Injection flaw allows an attacker to execute arbitrary commands on the server. OS Command Injection is a flaw where an application passes unsafe user-supplied data ...

PT-2026-96037

Name of the Vulnerable Software and Affected Versions Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656 Description A remote command injection flaw exists in the /send order.cgi endpoint. The issue occurs when the mac argument is manipulated, allowing an attacker to execute...

CVE-2026-55071: Improper Control of Generation of Code

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-84285: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...