EUVD-2026-83810

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-94098

A command injection vulnerability exists in the Netcore NBR200V2 router (firmware 1.3.241127.071246 ), specifically in the Firmware Upgrade CGI Endpoint at /www/cgi-bin/upgrade. An attacker can remotely exploit this by manipulating the QUERY_STRING argument, achieving high impact to confidentiali...

CVE-2026-94099: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERYSTRING results in command injection. The attack is possible to be carried o...

CVE-2026-55897: Improper Neutralization of Special Elements used in an OS Command

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

CVE-2026-62371: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

RHEL 8 : dracut (RHSA-2026:69119)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69119 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

SUSE SLES15 Security Update : dracut (SUSE-SU-2026:3997-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3997-1 advisory. Update to version 059+suse.730.g73d3411aa. - CVE-2026-6893: improper handling and escaping of DHCP options can lead to command...

CVE-2026-94095: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/networktools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

CVE-2026-84285: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-94139: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CVE-2026-94097: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...

CVE-2026-55071: Improper Control of Generation of Code

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-82412: Improper Neutralization of Special Elements used in an OS Command

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...