CVE-2026-71451

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71451

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-71451

An OS Command Injection vulnerability exists in Johnson Controls EasyIO FS32 (versions before 3.0b63 ). This flaw allows an attacker to execute arbitrary operating system commands. To remediate this issue, users should update the software to version 3.0b63 or later. Specific details regarding the...

EUVD-2026-91062

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63...

GO-2026-6557 KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-84682

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

CVE-2026-84682 TDDPv2 setProductVer Command Injection in Archer AX90

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

CVE-2026-84682 TDDPv2 setProductVer Command Injection in Archer AX90

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

CVE-2026-84682

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on the Archer AX90 V1 router. An unauthenticated attacker on an adjacent network can exploit the setProductVer command handler to execute arbitrary operating system commands with root privileges during the device boot ...

EUVD-2026-91040

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

CVE-2026-12545

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

CVE-2026-12542

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

CVE-2026-102294

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

RLSA-2026:74095 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...

rsync security, bug fix, and enhancement update

An update is available for rsync. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rsync utility enables the users to copy and synchronize files locally or...

CVE-2026-102369 Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-102369 Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294

The TP-Link TL-WR841N router is susceptible to an authenticated OS command injection vulnerability within the IPv6 WAN configuration . The root cause is the improper incorporation of a crafted IPv6 Gateway value into a system command. This allows an authenticated administrator to execute arbitrar...