CVE-2026-11732

Certain NETGEAR router models (including RAX and CAX series) are vulnerable to an insufficient input validation vulnerability within the Block Sites feature. A network-adjacent attacker with network access, such as WiFi credentials , can exploit this flaw to execute unauthorized commands on the r...

EUVD-2026-98771

Insufficient input validation vulnerability in time server NTP setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the...

CVE-2026-77099

The CVFS component is vulnerable to an input validation issue that allows for command execution . Impacted software customers are advised to upgrade to the resolved maintenance release to remediate the issue. No specific affected versions or exploit details are provided in the documents.

CVE-2026-77096

CVFS is impacted by a missing authentication condition that can affect command execution . The vulnerability allows for unauthorized actions due to the lack of proper authentication checks. To remediate this issue, software customers should upgrade to the resolved maintenance release and update C...

EUVD-2026-98761

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77096 CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77096 CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77099 CVFS Command Execution

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77099 CVFS Command Execution

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

EUVD-2026-98760

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-109409

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

Azure CycleCloud Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Microsoft Office OneNote Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Security Advisory Ivanti Connect Secure (CVE-2026-104935)

Update 13 Oct: Volexity Blog Post included in FAQ Summary Ivanti has released updates for Ivanti Connect Secure ICS which addresses one high severity vulnerability. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands. We are aware of exploitation in...

CVE-2026-74041 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as...

CVE-2026-74041 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as...

CVE-2026-74041 Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as...