CVE-2026-27548: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27550: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93353

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93357

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93340

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get iodd menu info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93344

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

PT-2026-93711

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93710

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242IEIMS version V1.06.01 Description The web management interface contains an OS Command Injection flaw, which occurs when an application fails to properly neutralize special elements used in an OS command. This allows a remote...

PT-2026-93343

A low-privileged remote attacker can exploit a command injection vulnerability in the Field Shadow Password class using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-20306: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...

rsync security, bug fix, and enhancement update

3.5.0-3 - Related: RHEL-246094 - OPATH for directory travesal full fix 3.5.0-2 - Related: RHEL-246094 - OPATH for directory traversal 3.5.0-1 - Resolves: RHEL-246094 - Rebase rsync to version 3.5.0 in RHEL10 - Resolves: RHEL-245337 - Directory escape via TOCTOU CVE-2026-53783 - Resolves:...

PT-2026-93865

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API of the affected software allows an authenticated remote attacker with administrative credentials to perform command...

PT-2026-93855

A vulnerability was found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate...

PT-2026-93341

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93698

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description The password change functionality within the 'portal.cgi' component contains an OS command injection flaw. The application fails to properly neutralize special elements ...