Astra Linux – Vulnerability in sshfs-fuse

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 up to 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path. The findbasepath function removes the brackets, leaving a host value that starts with a “-” and is passed directly to ssh as a...

Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Pypy

The mitigation of CVE-2026-4519 was incomplete. If the URL contained “%action”, the mitigation could be bypassed by certain browser types. In this case, the “webbrowser.open” API could allow commands to be injected into the underlying shell. See CVE-2026-4519 for details...

Astra Linux – Vulnerability in emacs

A command injection flaw was discovered in the text editor Emacs. This flaw could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirec...

Astra Linux – Vulnerability in Python-Click

This CVE record was assigned without following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit...

Astra Linux – Vulnerability in OpenSSL

In addition to the crehash shell command injection identified in CVE-2022-1292, further instances where the crehash script fails to properly sanitize shell metacharacters to prevent command injection were discovered during code reviews. When CVE-2022-1292 was fixed, it wasn’t recognized that ther...

CVE-2026-90705

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90706

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

EUVD-2026-77362

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90706

D-Link DWR-M921 firmware version 1.1.52 is affected by an OS command injection in the formWsc function of the /boafrm/formWsc file. The vulnerability is triggered by manipulating the targetAPSsid argument, allowing a remote, authenticated attacker (high privileges required) to execute arbitrary c...

CVE-2026-90706 D-Link DWR-M921 formWsc os command injection

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90706 D-Link DWR-M921 formWsc os command injection

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90704

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-90702

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-90703

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2026-90705

A OS command injection vulnerability was identified in D-Link DWR-M921 firmware version 1.1.52 . The flaw resides in the formsysCmd function of the file /boafrm/formsysCmd within the Boa Dispatch Table component. Manipulating the sysCmd argument allows a remote attacker with high privileges to in...

CVE-2026-90705 D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90705 D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

EUVD-2026-77356

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90704 D-Link DWR-M921 formDiskPartition system command injection

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...