CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562

Cronicle, a multi-server task scheduler and runner, contains a Stored XSS vulnerability in the administrator Activity Log prior to version 0.9.119 . The flaw exists in htdocs/js/pages/admin/Activity.js, where the item.user.full_name value is concatenated into HTML without proper encoding. Attacke...

CVE-2026-55376

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-102832

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...

Yiyi Wang Crossnote Command Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.28 contain a command injection vulnerability. This vulnerability stems from the handling of preview links, which pass the decoded link target to the Windows file open helper program. This program uses the start command to call childprocess.exec. When...

SonicWALL Network Security Manager (NSM) command injection vulnerability

SonicWALL Network Security Manager NSM versions 4.3.1 and earlier have a command injection vulnerability. This vulnerability stems from OS command injections, which may allow remote authentication attackers to execute arbitrary OS commands, resulting in remote code execution...

HPE NonStop Java JToolkit command injection vulnerability

HPE NonStop Java JToolkit T2716L11 and earlier versions contain a command injection vulnerability stemming from command injection and buffer overflow issues...

EG Secure Solutions SiteGuard Server Edition for Apache httpd: Command injection vulnerability

EG Secure Solutions SiteGuard Server Edition for Apache httpd has a command injection vulnerability. This vulnerability stems from OS command injection, and it may allow attackers to execute arbitrary OS commands with root or SYSTEM privileges on the system where the affected product is running...

TR7 Cyber Defense TR7 ASP Command Injection Vulnerability

Versions of TR7 Cyber Defense TR7 ASP from 1.0.40.236 to 1.0.1554.2331 and from 1.6.42.239 to 1.6.1554.2331 have a command injection vulnerability. This vulnerability stems from improper handling of special elements used in operating system commands, which may lead to command injection attacks...

TR7 Cyber Defense TR7 ASP Authorization Issue Vulnerability

Versions of TR7 CyberDefense TR7 ASP from 1.0.40.236 to 1.0.1554.2331 and from 1.6.42.239 to 1.6.1554.2331 contain authorization issue vulnerabilities. These vulnerabilities stem from the lack of authentication for critical functions, which may lead to OS command injection...

TP-Link HS103 v5 authorization issue vulnerability

The TP-Link HS103 v5 has an authorization issue vulnerability. This vulnerability stems from improper authentication in the local device management protocol; unauthenticated neighboring attackers can send management commands without sufficient authentication or authorization, potentially modifyin...

CVE-2026-104935

Ivanti Connect Secure (ICS) is vulnerable to an authentication bypass by spoofing (CWE-290) allowing a remote, unauthenticated attacker to execute arbitrary commands. The flaw affects ICS versions before 25.1.3.0 , excluding version 22.7R2.14 and prior. Exploitation in the wild is confirmed and a...

CVE-2026-77096

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77099

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-90228

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference by issuing a specific Identify command CNS 05h, CSI 02h ZNS targeting a file-backed namespace. This vulnerability occurs because the system attempts to access a block device that does...

CVE-2026-90293

A flaw was found in the Linux kernel's IB/isert module, which handles InfiniBand IB and iSCSI Extensions for RDMA iSER connections. A remote attacker could exploit this by sending a specially crafted SCSI command before a network session is fully established. This could lead to a system crash,...

EUVD-2026-98774

An insufficient input validation vulnerability in the website blocking feature Block Sites of the listed NETGEAR router models allows a network-adjacent attacker having network access such as WiFi credentials to run unauthorized commands on the router. This vulnerability could affect the...

CVE-2026-11732

Certain NETGEAR router models (including RAX and CAX series) are vulnerable to an insufficient input validation vulnerability within the Block Sites feature. A network-adjacent attacker with network access, such as WiFi credentials , can exploit this flaw to execute unauthorized commands on the r...

EUVD-2026-98771

Insufficient input validation vulnerability in time server NTP setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the...

CVE-2026-77099

The CVFS component is vulnerable to an input validation issue that allows for command execution . Impacted software customers are advised to upgrade to the resolved maintenance release to remediate the issue. No specific affected versions or exploit details are provided in the documents.