CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-90773

procs through 0.14.12 is vulnerable to terminal escape sequence injection via its Command column. The tool fails to sanitize ANSI or OSC escape sequences embedded in process command-line arguments before rendering them, allowing a local attacker with low privileges to craft a process whose comman...

CVE-2026-90770 Spug through 3.4.0 Remote Code Execution via ping_check

Spug through 3.4.0 contains a remote code execution vulnerability in the pingcheck function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/runtest/...

EUVD-2026-76991

Spug through 3.4.0 contains a remote code execution vulnerability in the pingcheck function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/runtest/...

CVE-2026-90492

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492

CVE-2026-90492 is an OS command injection vulnerability in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 . The flaw resides in the controller_listen/controller_recover functions of py/web.py , where unsanitized input in the case_name argument allows remote command execution. The attack can be...

EUVD-2026-76934

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

PT-2026-90976

Name of the Vulnerable Software and Affected Versions LB-LINK AC1900 AZ2 version 1.0.2 Description Command injection is possible through the use of shell metacharacters in the bs SetLimitCli info function located in the libshare.so library. This occurs when an actor makes a "POST /goform/set...

CVE-2026-35867: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-054006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054006 advisory. In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers t...

PT-2026-90779

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2026-090424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090424 advisory. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the...

CVE-2026-90492: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-35867

A command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-LINK router AC1900_AZ2 V1.0.2 . The flaw allows an attacker on the adjacent network to inject shell metacharacters via a POST /goform/set_LimitClient_cfg request, even without administr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2022-000996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000996 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...