Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Pypy

The mitigation of CVE-2026-4519 was incomplete. If the URL contained “%action”, the mitigation could be bypassed by certain browser types. In this case, the “webbrowser.open” API could allow commands to be injected into the underlying shell. See CVE-2026-4519 for details...

Astra Linux – Vulnerability in sshfs-fuse

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 up to 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path. The findbasepath function removes the brackets, leaving a host value that starts with a “-” and is passed directly to ssh as a...

Astra Linux – Vulnerability in emacs

A command injection flaw was discovered in the text editor Emacs. This flaw could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirec...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method. This vulnerability occurs when the $sourceReference parameter is appended to a shell command without proper escaping...

Astra Linux – Vulnerability in Python-Click

This CVE record was assigned without following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit...

Astra Linux – Vulnerability in Golang-1.15

Versions of Go before 1.14.14 and 1.15.x before 1.15.7 on Windows are vulnerable to Command Injection and remote code execution when using the “go get” command to fetch modules that utilize cgo for example, cgo can execute a GCC program from an untrusted source...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible, where a user’s controller is vulnerable to template injection. This issue can occur when facts used in the template do not include special template characters, especially if the user attempts to embed templates within multi-line YAML strings. This flaw allows...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection via crafted filenames...

Astra Linux – Vulnerability in OpenSSL

In addition to the crehash shell command injection identified in CVE-2022-1292, further instances where the crehash script fails to properly sanitize shell metacharacters to prevent command injection were discovered during code reviews. When CVE-2022-1292 was fixed, it wasn’t recognized that ther...

CVE-2026-90705

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90706

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90706

D-Link DWR-M921 firmware version 1.1.52 is affected by an OS command injection in the formWsc function of the /boafrm/formWsc file. The vulnerability is triggered by manipulating the targetAPSsid argument, allowing a remote, authenticated attacker (high privileges required) to execute arbitrary c...

EUVD-2026-77362

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90706 D-Link DWR-M921 formWsc os command injection

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90706 D-Link DWR-M921 formWsc os command injection

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90703

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2026-90702

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-90704

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...