CVE-2026-90492 webgjc web_robot web.py controller_recover os command injection

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

EUVD-2026-76934

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-054006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054006 advisory. In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers t...

PT-2026-90779

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-35867

A command injection vulnerability in the bs_SetLimitCli_info function of the libshare.so library affects the LB-LINK router AC1900_AZ2 V1.0.2 . The flaw allows an attacker on the adjacent network to inject shell metacharacters via a POST /goform/set_LimitClient_cfg request, even without administr...

PT-2026-90976

Name of the Vulnerable Software and Affected Versions LB-LINK AC1900 AZ2 version 1.0.2 Description Command injection is possible through the use of shell metacharacters in the bs SetLimitCli info function located in the libshare.so library. This occurs when an actor makes a "POST /goform/set...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

CVE-2026-90492: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in webgjc webrobot 2.4.0/2.5.0/2.8.0. The affected element is the function controllerlisten/controllerrecover of the file py/web.py. The manipulation of the argument casename leads to os command injection. It is possible to initiate the attack remotely...

CVE-2026-35867: Improper Neutralization of Special Elements used in an OS Command

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2022-000996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000996 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2026-090424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090424 advisory. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the...

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. Details of the...

EUVD-2026-76749

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

OS Command Injection

OmniRoute is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of attacker-controlled binary and versionCommand values before executing them with execFileSync, which allows an unauthenticated attacker under certain configurations to supply interpreter...

CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444

CVE-2026-90444 describes a shell metacharacter injection vulnerability in a file-transfer interface within an ICS/OT product (per CISA advisory ICSA-26-254-01). The interface requires valid credentials but does not restrict shell metacharacters in uploaded filenames. An automated process later co...