Martin Legrand AgenticSeek debug information leakage vulnerability

Martin Legrand AgenticSeek has a debug information leakage vulnerability. This vulnerability stems from the fact that llmserver/app.py hardcodes Flask debug mode and binds all interfaces. Once an attacker accesses the server port and obtains a determinable Werkzeug debugger PIN, it may be possibl...

Linux Distros Unpatched Vulnerability : CVE-2026-113732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX...

Mervin Praison PraisonAI authorization issue vulnerability

Versions 4.5.112 through 4.6.59 of Mervin Praison PraisonAI contain an authorization issue vulnerability. This vulnerability arises because the recipe command can start a Recipe HTTP server on non-local host interfaces without authentication; no authentication configuration is present...

D-Link DAP1160L security vulnerability

The D-Link DAP1160L A1 firmware version FW101WWb04 contains a security vulnerability. This vulnerability stems from OS command injection in the /htdocs/web/diagnostic.php endpoint, allowing attackers to execute arbitrary commands by injecting any shell metacharacters...

Cacti command injection vulnerability

Versions of Cacti prior to 1.2.31 contain a command injection vulnerability. This vulnerability arises because the blacklist does not include single quotes, double quotes, redirection operators, nor parentheses or brackets for sub-shells. Authenticated administrators can save an inputstring...

Linux Distros Unpatched Vulnerability : CVE-2026-113726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment...

Linux Distros Unpatched Vulnerability : CVE-2026-98914

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with executedepth and return -ELOOP when exceeded. CVE-2026-98914 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-113725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of...

ASUS Router command injection vulnerability

The ASUS Router 3.0.0.6.102 series version contains a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands. Remote users can send specially crafted parameters to the router, allowing them to execute arbitrary commands with root...

Aider AI command injection vulnerability

Aider AI versions 0.86.2 and earlier contain a command injection vulnerability. This occurs because submitted malicious .aider.conf.yml files are automatically loaded without any trust warnings. Attackers can set values for notifications-command or editor; after using /editor, they can execute...

Mervin Praison PraisonAI command injection vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.6.10 up to but not including 4.6.59. This vulnerability stems from LocalManagedAgent / SandboxedAgent calculation bridging, which constructs shell commands using raw path parameters when processing readfile, listfiles, an...

ASUS Router cross-site request forgery vulnerability

Versions 3.0.0.6.102 and later of the ASUS Router contain a security vulnerability stemming from OS command injection and cross-site request forgery. This flaw may allow attackers to trick authenticated administrators into visiting phishing sites, thereby enabling the router to execute arbitrary...

DJI CrystalSky ZS600C command injection vulnerability

Versions DJI CrystalSky ZS600C from 0.3.9.7 through 0.6.6.9 contain a command injection vulnerability. This vulnerability arises because the hardwaremonitor helper program running with root privileges allows OS command injection. Local unprivileged processes can write specially crafted content to...

PT-2026-135394

Fix IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. Fix SSRF...

DJI CrystalSky ZS600C processing logic error vulnerability

Versions DJI CrystalSky ZS600C from 0.3.9.7 through 0.6.6.9 contain a logic error vulnerability. This vulnerability stems from an unrecorded backdoor within the “assistant” daemon running with root privileges. Physical access and USB access allow attackers to send the hard-coded string...

PT-2026-121884

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the ATOM command table nesting depth is not capped. This is addressed by limiting nesting to 32 levels using execute depth and returning...

PT-2026-122456

ANT-2026-R7FKP7RG Win32 quote cmd filename misses pipe/redirect metacharacters ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe quote/make cmdline ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped Also includes the fix for OSEC-2026-05 Filename.quote comman...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-122411

Summary An infinite-loop vulnerability CWE-835 in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int and never rejects a negative value. A negative size such as -100 drives...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...