PT-2026-102401

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/set passwd endpoint. This occurs when the password1 argument is manipulated, allowing an attacker to execute arbitrary commands on the...

PT-2026-99883

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ip argument within the /ap ip.cgi endpoint, which is processed by the system...

CVE-2026-86530: Improper Neutralization of Special Elements used in an OS Command

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

PT-2026-99812

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi products affected versions not specified Description BUFFALO Wi-Fi products improperly handle input from web forms when assembling internal command line strings. This allows an administrative user to execute arbitrary operating...

Docker Control System Record-Output Command Execution

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

OpenVpnClientCfg Function Command Execution

The vulnerability of the setOpenVpnClientCfg function in the Totolink A8000RU router’s microprogramming software is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system command...

TOTOLINK WA300 recvUpgradeNewFw() Arbitrary Command Execution

The vulnerability of the recvUpgradeNewFw function /cgi-bin/cstecgi.cgi in the TOTOLINK WA300 router microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Totolink A8000RU Router Command Execution

The vulnerability of the setWiFiBasicCfg function in Totolink A8000RU router microprogramming software is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands using a...

Input Leap Arbitrary Command Execution

Missing authentication for a critical function in the input-leapd daemon of Input Leap, the open-source keyboard and mouse sharing tool, allows a local, low-privileged user on Windows to execute arbitrary commands as NT AUTHORITY\SYSTEM by sending a single IPC command message to the daemon's...

PT-2026-99784

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Unzip Handler component. A remote attacker can exploit this by manipulating the Password argument within the panelTask.bt task. unzip function locate...

PT-2026-99783

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A command injection issue exists in the File Merge Handler component within the merge split file function located in the /www/server/panel/class/files.py file. A remote attacker can exploit th...

CVE-2026-86102: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

PT-2026-99942

Name of the Vulnerable Software and Affected Versions WatchGuard AP affected versions not specified Description An OS command injection flaw exists in the internal API service. This issue allows an attacker with network access to the access point to execute arbitrary shell commands on the...

Important: environment-modules

Issue Overview: modulecomgenwordsandfiles fed untrusted text module names read off disk, LOADEDMODULES, MODULEPATH straight into compgen -W, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module...

Important: gdb

Issue Overview: A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

RHEL 9 : pcp (RHSA-2026:72272)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72272 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RHEL 10 : pcp (RHSA-2026:72273)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72273 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

CVE-2026-86330: Improper Neutralization of Special Elements used in an OS Command

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-12268: Improper Input Validation

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...