PT-2026-80993

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2025-26237

CVE-2025-26237 affects the D-Link DI-7001 MINI_5G (firmware 19.10.31A1 ). The vulnerability is a code execution flaw in the flag parameter of msp_info , allowing an attacker on the adjacent network to execute arbitrary commands without authentication or user interaction. The CVSS v3.1 score is 8....

Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers...

MiracleLinux 9 : sg3_utils-1.47-10.el9_8.1 (AXSA:2026-1623:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1623:02 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Tenable has extracted the preceding description...

CVE-2026-78141

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-78141 Tenda CH22 exeCommand formexeCommand command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-78141

A command injection vulnerability exists in Tenda CH22 firmware version 1.0.0.1 . The flaw resides in the function formexeCommand within the file /goform/exeCommand , where unsanitized manipulation of the argument cmdinput allows an attacker to inject arbitrary commands. The attack is remotely ex...

vuln-labs-angara

vuln-labs-angara Семь независимых Docker-стендов с уязвимыми...

Vulnerability handling in Zimbra Collaboration Suite

Zimbra has identified a vulnerability in the Zimbra Collaboration Suite. This vulnerability exists in the Zimbra Collaboration Suite version 10.1.20. Unauthorized attackers can execute OS commands through specially crafted SMTP requests. This requires that the Zimbra SNMP package be installed and...

CVE-2026-78063

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

CVE-2026-78063 Tenda CH22 editFileName formeditFileName command injection

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

CVE-2026-78063

A command injection vulnerability exists in Tenda CH22 firmware version 1.0.0.1 . The flaw is in the function formeditFileName within the file /goform/editFileName , where manipulation of the editNameMit argument allows an authenticated remote attacker to inject and execute arbitrary commands. Th...

EUVD-2026-64632

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the...

PT-2026-79783

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

Exploit for CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injec...

Exploit for CVE-2026-52616

CVE-2026-52616 — mcp-nmap-server: OS command injection via ru...

Deserialization of Untrusted Data

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via unsafe deserialization in AllowlistUnpickler. An attacker can execute arbitrary commands by supplying a...

UBUNTU-CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...

CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...

CVE-2026-68766

hashcat through 7.1.2 is vulnerable to arbitrary file write via restore file option injection. The restore file parser (in src/restore.c) fails to restrict command-line options, allowing an attacker to inject directives such as --outfile and --potfile-path into a crafted restore file. This enable...