EUVD-2026-76991

Spug through 3.4.0 contains a remote code execution vulnerability in the pingcheck function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/runtest/...

CVE-2026-90770 Spug through 3.4.0 Remote Code Execution via ping_check

Spug through 3.4.0 contains a remote code execution vulnerability in the pingcheck function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/runtest/...

CVE-2026-90492

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492

CVE-2026-90492 is an OS command injection vulnerability in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 . The flaw resides in the controller_listen/controller_recover functions of py/web.py , where unsanitized input in the case_name argument allows remote command execution. The attack can be...

EUVD-2026-76934

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2026-090424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090424 advisory. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the...

PT-2026-90779

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-LINK router AC1900_AZ2 V1.0.2 . The flaw allows an attacker on the adjacent network to inject shell metacharacters via a POST /goform/set_LimitClient_cfg request, even without administr...

PT-2026-90976

Name of the Vulnerable Software and Affected Versions LB-LINK AC1900 AZ2 version 1.0.2 Description Command injection is possible through the use of shell metacharacters in the bs SetLimitCli info function located in the libshare.so library. This occurs when an actor makes a "POST /goform/set...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-054006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054006 advisory. In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2022-000996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000996 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-90492: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-35867: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...

EUVD-2026-76749

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

OS Command Injection

OmniRoute is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of attacker-controlled binary and versionCommand values before executing them with execFileSync, which allows an unauthenticated attacker under certain configurations to supply interpreter...