Dell PowerProtect Data Domain command injection vulnerability

Versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from stack buffer overflows and may allow unauthenticated remote attackers to execute...

CVE-2026-103780: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An...

CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 IPsec Command Injection

Moxa MAR-2000 firmware version FWRMAR2000V1.0Build15010909 contains an authenticated IPsec tunnel address command injection vulnerability. The supplied proof of concept stores a shell command in the local VPN address field through the management REST interface...

PT-2026-128063

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An...

CVE-2026-118607: Improper Neutralization of Special Elements used in an OS Command

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

CVE-2013-20007: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to…

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timerinterval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and ru...

TencentOS Server 4: lrzsz (TSSA-2026:1207)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1207 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-86395: Dell PowerProtect Data Domain Virtual Edition: Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-116778: Improper Neutralization of Special Elements used in an OS Command

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

PT-2026-128091

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

Linksys WAG200G command injection vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain a command injection vulnerability. This vulnerability arises from OS command injection via the timerinterval parameter. Attackers can send specially crafted POST requests to setup.cgi to launch telnetd or download and execute backdoors,...

PT-2026-128315

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-86399: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

CVE-2026-115904: topluyo App: Topluyo is a social networking platform

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-118692: giuspen cherrytree: CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows…

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-118179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was no...

Juniper Networks Session Smart Router command injection vulnerability

A command injection vulnerability exists in Juniper Networks Session Smart Router and Session Smart Conductor versions prior to 7.0.5, from 7.1.0 up to versions prior to 7.1.7, and from 7.2.0 up to versions prior to 7.2.3. This vulnerability stems from improper handling of special elements within...

CVE-2026-86400: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...