179264 matches found
CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
CVE-2026-53542
CVE-2026-53542 is a tar option injection vulnerability in Termix , a web-based server management platform, prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-selected file basenames to tar without an end-of-options marker (--) and without ensuring...
EUVD-2026-62858
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
CVE-2026-76582
TRENDnet TEW-821DAP firmware 2.2.01b05 passes the unsanitized ipaddr argument from /cgi-bin/ping.cgi to popen/system in the ssi component, enabling remote command injection; a proof-of-concept exploit is publicly available on GitHub. No patch or workaround is mentioned in the provided documents.
EUVD-2026-62852
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...
CVE-2026-76582 TRENDnet TEW-821DAP ssi ping.cgi system command injection
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...
CVE-2026-76582 TRENDnet TEW-821DAP ssi ping.cgi system command injection
A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...
CVE-2026-69220 vulnerabilities
Vulnerabilities for packages: zipkin, traccar-fips, nuxeo, cassandra-reaper, druid, conductor-fips, logstash-fips, thingsboard, conductor, logstash, traccar...
CVE-2026-69219 vulnerabilities
Vulnerabilities for packages: zipkin, traccar-fips, nuxeo, cassandra-reaper, druid, conductor-fips, logstash-fips, thingsboard, conductor, logstash, traccar...
GO-2026-4950 vulnerabilities
Vulnerabilities for packages: dapr-fips, dapr...
GHSA-JJ7C-H3WM-VJFW vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-69220 vulnerabilities
Vulnerabilities for packages: logstash, cassandra-reaper, druid, thingsboard, zipkin...
CVE-2026-63335 vulnerabilities
Vulnerabilities for packages: logstash, cassandra-reaper, druid, thingsboard, zipkin...
CVE-2026-69219 vulnerabilities
Vulnerabilities for packages: logstash, cassandra-reaper, druid, thingsboard, zipkin...
GHSA-68MJ-5WR7-6FGG vulnerabilities
Vulnerabilities for packages: logstash, cassandra-reaper, druid, thingsboard, zipkin...
GHSA-QX7J-JV8M-FPPR vulnerabilities
Vulnerabilities for packages: logstash, cassandra-reaper, druid, thingsboard, zipkin...
GHSA-FJ27-X67R-V4G5 vulnerabilities
Vulnerabilities for packages: busybox...
GHSA-9R55-P3JW-V652 vulnerabilities
Vulnerabilities for packages: busybox...
CVE-2026-68560
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...
CVE-2026-63187
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...