CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105487

The yogeshojha reNgine software (versions up to 2.2.0 ) is vulnerable to an OS command injection vulnerability within the listTargets Endpoint . Specifically, the subdomain_discovery function located in the web/reNgine/tasks.py file fails to properly neutralize the Name argument. This flaw allows...

CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105484

The TOTOLINK X6000R running firmware version 9.4.0cu.652_B20230116 is vulnerable to an OS command injection vulnerability. The flaw exists within the UploadFirmwareFile Handler component, specifically in the firmware_check function of the /cgi-bin/cstecgi.cgi file. An attacker can exploit this by...

CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

EUVD-2026-92908

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

cve-2020-24572

CVE-2020-24572 Se descubrió un problema en includes/webconsole.php en RaspAP 2.5. Con acceso autenticado, un atacante puede utilizar una consola web mal configurada y prácticamente sin restricciones para atacar el sistema operativo subyacente que ejecuta este software, y ejecutar comandos en el...

CVE-2026-105744

A flaw was found in docling. When configured to process LaTeX documents using the Tectonic engine, the application does not restrict TeX file operations during compilation. An attacker could exploit this vulnerability by submitting crafted document input to read sensitive files or overwrite...

PT-2026-106750

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...

PT-2026-106726

Name of the Vulnerable Software and Affected Versions lrzsz versions prior to 0.13.0 Description The lrz receive utility contains an OS command injection flaw in its pipe mode. This occurs when lrz is executed under a suffixed name, such as lrztar, causing the procheader function in src/lrz.c to...

CVE-2026-57545: Untrusted Pointer Dereference

Memory corruption when processing draw objects of incorrect type during graphics command list execution...

PT-2026-106347

Name of the Vulnerable Software and Affected Versions Android Camera driver affected versions not specified Description Memory corruption occurs when the Android Camera driver processes command buffer requests that contain invalid length parameters. Recommendations At the moment, there is no...

PT-2026-107259

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

PT-2026-106738

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...

PT-2026-107257

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

PT-2026-107333

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper input validation leads to the improper neutralization of special elements used in an OS command, allowing a remote authenticated attacker to perform code injection and execute...

PT-2026-107258

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

CVE-2026-102160: Improper Neutralization of Special Elements used in an OS Command

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...