The vulnerability of the wsrep_notify_cmd() function in the MariaDB database management system allows a hacker to execute arbitrary commands.

The vulnerability of the wsrepnotifyCmd function in the MariaDB database management system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the uploadDir() function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager software from Incus, which allows a attacker to execute arbitrary commands.

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

The vulnerability of the `wsrep_sst_receive_address` and `wsrep_sst_donor` parameters in the `sql/wsrep_sst.cc` file of the MariaDB database management system allows a hacker to execute arbitrary commands.

The vulnerability of the wsrepsstreceiveaddress and wsrepsstdonor parameters in the sql/wsrepsst.cc file of the MariaDB database management system is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability may allow an attacker operating remotely...

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

PT-2026-96189

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.21.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0 Description ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated...

CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

PT-2026-96232

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2 Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are...

PT-2026-96300

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user with AI feature access can execute dangerous statements or database functions because the runQuery function in server/modules/ai/orchestrator/tools/runQuery.js uses an...

PT-2026-104829

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to scan.lua and scripts/lua/rest/v2/exec/host/schedule vulnerability scan.lua accept the scan ports parameter without an administrator gate and pass it...

PT-2026-96257

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Assistants utilizing a tool, MCP tool, skill, or sub-application use the SandboxShellBackend, which exposes an execute shell tool. Because the execute function is omitted from the interrupt on...

CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

EulerOS Virtualization 2.10.1 : vim (EulerOS-SA-2026-3858)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim...

EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-3892)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim...

ROS-20260921-73-0073

The vulnerability in the incus is related to the insertion or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-77521: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...

VulnCheck KEV: CVE-2026-7273

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

RHEL 10 : sg3_utils (RHSA-2026:69124)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69124 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Rclone vulnerability (USN-8782-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8782-1 advisory. It was discovered that Rclone incorrectly handled unauthenticated requests to the remote...