193420 matches found
CVE-2026-75775
Certain ASUS routers are vulnerable to an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. A remote user can execute arbitrary commands with root privileges by sending crafted parameters to the router, specifically when the devi...
EUVD-2026-108608
Improper Neutralization of Special Elements used in an OS Command “OS Command Injection” and Cross-Site Request Forgery CSRF in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root...
CVE-2026-75779
Improper Neutralization of Special Elements used in an OS Command “OS Command Injection” and Cross-Site Request Forgery CSRF in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root...
CVE-2026-75779
Improper Neutralization of Special Elements used in an OS Command “OS Command Injection” and Cross-Site Request Forgery CSRF in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root...
CVE-2026-75779
An OS Command Injection and Cross-Site Request Forgery (CSRF) vulnerability exists in an ASUS router model. An attacker can trick a logged-in administrator into visiting a phishing website, which triggers the router to execute arbitrary commands with root privileges . For further information and ...
Pillow Multi-frame Loaders Can Reuse Stale Native Image Storage After Mode Transitions
Summary Pillow multi-frame image loaders can retain native "ImagingCore" storage allocated for one frame while changing the Python-side image "mode" and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as "L", and a later frame of the same dimensions switches t...
Updated roundcubemail package fixes security vulnerabilities
Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. Fix SSRF...
CVE-2026-115547
An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...
[SECURITY] [DSA 6579-1] roundcube security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 23, 2026 https://www.debian.org/security/faq -...
CVE2026
php2shell — CVE-2026-109618 / CVE-2026-109619 Critical Ad...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2SHELL POC Lab Lab edukasi untuk mendemonstrasikan teknik...
CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway
An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...
CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway
An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...
CVE-2026-115547
The Okta Access Gateway (OAG) Admin Console is vulnerable to Command Execution due to an input validation issue that allows the processing of specially formatted configuration values. An authenticated administrator can exploit this vulnerability to execute arbitrary system commands within the con...
ElasticSearch - Remote Code Execution
ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine. id: CVE-2015-1427 info: name: ElasticSearch - Remote Code Execution author: pikpikcu...
CVE-2026-19677
The onPhase/ frevvo registration form version 11.0.14 contains an authentication bypass vulnerability. An unauthenticated remote attacker can manipulate registration parameters—specifically by providing a valid tenant name and an existing user identifier—to authenticate as an arbitrary tenant use...
CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulatio...
CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulatio...
EUVD-2026-108548
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...