Astra Linux – vulnerability in openssh

In OpenSSH versions prior to 9.6, OS command injection may occur if a username or hostname contains shell metacharacters, and such names are referenced via expansion tokens in certain scenarios. For instance, an untrusted Git repository might contain a submodule with shell metacharacters in its...

Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.51 contains an incomplete command injection blocklist, which fails to account for Git’s feature of abbreviating long-option names. Attackers can bypass the safety measures by using abbreviated option names, such as “uploadp” instead of “uploadpack”. Git will then trea...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.51 fails to protect against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote. This allows command injection through options such as --exec/--upload-pack, leading to arbitrary command execution. Additionally, Repo.itercommits and...

Astra Linux – Vulnerability in Node.js

A OS command injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check. This vulnerability can be easily exploited, as the IsIPAddress function does not properly check whether an IP address is invalid before making DBS requests, thereby...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

Astra Linux – Vulnerability in Zabbix

Zabbix allows for the configuration of SMS notifications. AT command injection occurs on the “Zabbix Server” because there is no validation of the “Number” field either on the web interface or on the Zabbix server side. An attacker can send specially crafted phone numbers via SMS and execute...

Astra Linux – vulnerability in vim

Vim is an open source, command line text editor. Prior to version 9.2.0435, there was an OS command injection vulnerability in Vim’s :find command-line completion. When the path option contained backtick-enclosed shell commands, those commands were executed during filename completion. Since the...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, before versions 2.2.24 and 2.7.7, the composer install command executed within a Git/HG repository with specially crafted branch names could lead to command injection. This required cloning untrusted repositories. Patches are available ...

Astra Linux – vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method. This method constructs shell commands by interpolating user-supplied Perforce connection parameters—such as port, user,...

Astra Linux – Vulnerability in libimage-exiftool-perl

In ExifTool’s lib/Image/ExifTool.pm, version 12.38 incorrectly handles the $file = /|$/ check, resulting in command injection...

CVE-2026-45449 Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-45449 Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

EUVD-2026-102133

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-45449

The Unitronics UniStream Pro/UniLogic systems are vulnerable to an OS Command Injection (CWE-78) vulnerability. This flaw is caused by the improper neutralization of special elements used in an OS command. The issue specifically affects Unitronics UniStream Pro versions only (B10 / C10) and UniLo...

CVE-2026-110957

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

CVE-2026-104586

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

SUSE CVE-2026-55601

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

EUVD-2026-102100

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...