156543 matches found
CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
CVE-2026-53542
CVE-2026-53542 is a tar option injection vulnerability in Termix , a web-based server management platform, prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-selected file basenames to tar without an end-of-options marker (--) and without ensuring...
EUVD-2026-62858
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
CVE-2026-76582
TRENDnet TEW-821DAP firmware 2.2.01b05 passes the unsanitized ipaddr argument from /cgi-bin/ping.cgi to popen/system in the ssi component, enabling remote command injection; a proof-of-concept exploit is publicly available on GitHub. No patch or workaround is mentioned in the provided documents.
EUVD-2026-62852
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...
CVE-2026-76582 TRENDnet TEW-821DAP ssi ping.cgi system command injection
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...
CVE-2026-69220 vulnerabilities
Vulnerabilities for packages: thingsboard, traccar-fips, cassandra-reaper, zipkin, traccar, druid, logstash, conductor, nuxeo, conductor-fips, logstash-fips...
CVE-2026-69219 vulnerabilities
Vulnerabilities for packages: thingsboard, traccar-fips, cassandra-reaper, zipkin, traccar, druid, logstash, conductor, nuxeo, conductor-fips, logstash-fips...
GO-2026-4950 vulnerabilities
Vulnerabilities for packages: dapr-fips, dapr...
GHSA-JJ7C-H3WM-VJFW vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-69220 vulnerabilities
Vulnerabilities for packages: druid, cassandra-reaper, logstash, zipkin, thingsboard...
CVE-2026-63335 vulnerabilities
Vulnerabilities for packages: druid, cassandra-reaper, logstash, zipkin, thingsboard...
CVE-2026-69219 vulnerabilities
Vulnerabilities for packages: druid, cassandra-reaper, logstash, zipkin, thingsboard...
GHSA-68MJ-5WR7-6FGG vulnerabilities
Vulnerabilities for packages: druid, cassandra-reaper, logstash, zipkin, thingsboard...
GHSA-QX7J-JV8M-FPPR vulnerabilities
Vulnerabilities for packages: druid, cassandra-reaper, logstash, zipkin, thingsboard...
GHSA-FJ27-X67R-V4G5 vulnerabilities
Vulnerabilities for packages: busybox...
GHSA-9R55-P3JW-V652 vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-68560
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...
CVE-2026-63187
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63722
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...