The vulnerability of the SSHFS file system’s client’s find_base_path() function allows a hacker to execute arbitrary commands.

The vulnerability of the findbasepath function in the SSHFS file system lies in the ability to exploit or modify arguments. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

EUVD-2026-66745

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

CVE-2026-75364

Comfast CF-N1-S (firmware 2.6.0.1) and CF-WR630AX (2024-01-30 build) contain a command injection vulnerability in the update_interface_png SET handler within /usr/bin/webmgnt. The unsanitized display_name parameter is concatenated via sprintf() into the unquoted shell command /etc/rrd/graphinterf...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...

CVE-2026-75364

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

CVE-2026-52473

CVE-2026-52473 affects Wgcloud 3.6.4 , a web-based application. The root cause is that the content parameter is directly concatenated to a ProcessBuilder , allowing a remote attacker to escalate privileges. The CVSS 3.1 score is 4.3 (MEDIUM) with an adjacent network attack vector, low complexity,...

PT-2026-82208

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 4.5.13 Nagios XI versions prior to 2026R1.5 Description A Cross-Site Request Forgery CSRF issue exists in the 'cmd.cgi' endpoint. When the Cookie header is missing, the double-submit cookie protection mechanism ca...

PT-2026-82192

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the drm/amdgpu component, the amdgpu cs p2 ib function fails to limit user-supplied ib bytes when passing them to ib-length dw. Because ring emit ib encodes this length into packet...

EUVD-2026-66754

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098843)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098843 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp-cmd ufshcdqueuecommand may be called two times in a row for...

Linux Distros Unpatched Vulnerability : CVE-2026-48548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormI...

CVE-2026-75414

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability...

PT-2026-82254

Name of the Vulnerable Software and Affected Versions Dell PowerProtect One versions 20.1.0.0 and earlier Description An improper neutralization of special elements used in an OS command allows a low privileged attacker with remote access to perform OS Command Injection, which can lead to remote...

PT-2026-82046

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host for Linux versions prior to 15.81.5 Description A command injection issue exists that allows a remote attacker to execute arbitrary commands with the privileges of the current user. This occurs when a user click...

PT-2026-82085

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device...

EUVD-2026-66746

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability...

PT-2026-82213

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied...

EUVD-2026-66744

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

GitLab 18.9 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-18252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...