CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-122411

Summary An infinite-loop vulnerability CWE-835 in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int and never rejects a negative value. A negative size such as -100 drives...

CVE-2026-52356

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

Okta Access Gateway input validation error vulnerability

A security vulnerability exists in Okta Access Gateway versions prior to 2026.10.2. This vulnerability stems from improper input validation in the Admin Console, allowing specially crafted configuration values to be processed. Authenticated administrators can exploit this to execute system comman...

Linux Distros Unpatched Vulnerability : CVE-2026-106583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. CVE-2026-106583 Note that Nessus relies on the...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1792794952)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792794952 advisory. - The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replac...

Curl 7.30.0 < 8.22.0 IMAP Command Injection

The version of curl installed on the remote host is 7.30.0 prior to 8.22.0. It is, therefore, affected by a command injection vulnerability: - Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The serv...

VulnCheck KEV: CVE-2021-23337

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function...

PT-2026-122218

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command...

Mervin Praison PraisonAI command injection vulnerability

Versions Mervin Praison PraisonAI from 4.5.87 through 4.6.61 contain a security vulnerability. This vulnerability arises because the recipe’s execution strategy for dangerous tools only checks the requires.tools field in TEMPLATE.yaml; it fails to validate the agent-level tools declarations and...

Zimbra Collaboration Suite permission and access control issue vulnerability

Zimbra Collaboration Suite versions 10.1.21 and earlier contain a vulnerability related to permission escalation and access control. This issue arises because the sudo policy in the ZCS MTA package permits unauthenticated execution of Postfix management commands under root privileges without any...

Zimbra Collaboration Suite command injection vulnerability

Zimbra Collaboration Suite versions 10.1.21 and earlier contain a command injection vulnerability. This vulnerability arises because the passwordless sudo interface in the zmmailboxdmgr launcher accepts JVM parameters without adequate restrictions. Attackers can delay Jetty privilege downgrade,...

Juniper Networks J-Web Arbitrary Command Execution

The vulnerability in the J-Web management web interface of Juniper Networks Junos OS is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

Snort Auth Bypass Command Execution

The vulnerability of the Snort intrusion detection system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-113718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII...

SUSE CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model LLM provider endpoints during queries. If a user enters sensitive data-such as API tokens,...

CVE-2026-107861

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

benevolent-php

benevolent-php — PHP2Shell lab CVE-2026-109618 / CVE-2026-109...

CVE-2026-105014

Improper neutralization of special elements used in a command 'command injection' in Azure Pipelines allows an unauthorized attacker to execute code over a network...

CVE-2026-110243 Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...