PT-2026-99783

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A command injection issue exists in the File Merge Handler component within the merge split file function located in the /www/server/panel/class/files.py file. A remote attacker can exploit th...

PT-2026-102400

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the /api/ZRQos/set online client endpoint. An attacker can exploit this by manipulating the mac argument to execute arbitrary...

PT-2026-102401

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/set passwd endpoint. This occurs when the password1 argument is manipulated, allowing an attacker to execute arbitrary commands on the...

PT-2026-99812

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi products affected versions not specified Description BUFFALO Wi-Fi products improperly handle input from web forms when assembling internal command line strings. This allows an administrative user to execute arbitrary operating...

PT-2026-99772

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Database Backup Handler component. The issue occurs within the InputSql function located in the class/database.py file. A remote attacker can exploit...

PT-2026-102358

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description An issue exists in the USB Device Management API within the file usr/lib/lua/luci/controller/api/zrUsb.lua. A remote attacker can perform command injection by manipulating the path argument passed...

PT-2026-99883

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ip argument within the /ap ip.cgi endpoint, which is processed by the system...

PT-2026-99914

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ntp ip argument within the /set ntp server ip.cgi endpoint, which affects th...

PT-2026-99943

Name of the Vulnerable Software and Affected Versions WatchGuard AP affected versions not specified Description An OS command injection flaw in the diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by providing specially crafted input...

PT-2026-99845

Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description The instance-management service InstanceServiceImpl constructs the command line for launching a child Karaf JVM using string concatenation, which is then executed via /bin/sh on Unix or...

PT-2026-102398

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup wifi. Executing a manipulation of the argument login pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-99958

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-101008: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

Input Leap Arbitrary Command Execution

Missing authentication for a critical function in the input-leapd daemon of Input Leap, the open-source keyboard and mouse sharing tool, allows a local, low-privileged user on Windows to execute arbitrary commands as NT AUTHORITY\SYSTEM by sending a single IPC command message to the daemon's...

PT-2026-102391

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/firstLogin endpoint. This occurs when the firstLogin argument is manipulated, allowing an attacker to execute arbitrary commands on th...

CVE-2026-78424: Improper Neutralization of Special Elements used in an OS Command

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-55157: Improper Neutralization of Special Elements used in an OS Command

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-12267: Improper Input Validation

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

PT-2026-99810

Name of the Vulnerable Software and Affected Versions eBA Plus Document and Workflow Management System versions 6.7.141 through 10.0.10 Description An unrestricted upload of files with dangerous types allows an attacker to upload a web shell to the web server, which can lead to remote command...

CVE-2026-12268: Improper Input Validation

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...