HPE AOS-CX 安全漏洞

HPE AOS-CX is a network operating system developed by Hewlett-Packard Enterprise HPE for data centers, campuses, and edge locations. It is designed to provide flexible and innovative network services while enhancing network performance. HPE AOS-CX contains a security vulnerability, which stems fr...

xygeni-action 安全漏洞

Oxyni-action is a GitHub code security scanning workflow plugin developed by Xygeni. Oxyni-action has a security vulnerability that stems from tag poisoning, which can lead to supply chain attacks, allowing attackers to execute arbitrary commands on the CI runner...

VulnCheck KEV: CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

Comtrend AR-5310 安全漏洞

The Comtrend AR-5310 is a wireless router device produced by the Comtrend company in the United States. The Comtrend AR-5310 GE31-412SSG-C01R10.A2pG039u.d24k version contains a security vulnerability. This vulnerability stems from command substitution bypasses in the restricted shell, which may...

Cursor 操作系统命令注入漏洞

Cursor is an AI-powered intelligent code editor developed by Cursor Open Source. Prior to Cursor 2.0, there was a vulnerability related to operating system command injection. This vulnerability stemmed from the possibility of the model executing malicious instructions, which could lead to automat...

Hewlett Packard Enterprise AOS（HPE AOS） 安全漏洞

Hewlett Packard Enterprise AOS is a network operating system developed by Hewlett Packard Enterprise in the United States. It is used for data centers, campus networks, and edge computing environments. Hewlett Packard Enterprise AOS HPE AOS contains security vulnerabilities. These vulnerabilities...

VulnCheck KEV: CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Lantronix EDS5000 安全漏洞

The Lantronix EDS5000 is a serial port device server developed by the American company Lantronix. The Lantronix EDS5000 2.1.0.0R3 version contains a security vulnerability. This vulnerability stems from improper handling of the tunnel parameter, which may allow authenticated attackers to inject a...

PT-2026-24571

Name of the Vulnerable Software and Affected Versions AOS-CX Switches affected versions not specified Description A flaw exists in the command line interface of AOS-CX Switches that could allow a remote attacker with valid credentials to execute arbitrary commands on the operating system...

PT-2026-24781

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to...

Splunk Enterprise 9.3.0 < 9.3.10, 9.4.0 < 9.4.9, 10.0.0 < 10.0.4 (SVD-2026-0302)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0302 advisory. - In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5,...

CVE-2025-67037

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges...

PT-2026-24819

Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.10.2 and earlier Description OliveTin allows access to predefined shell commands through a web interface. In versions 3000.10.2 and earlier, the live EventStream broadcasts execution events and action output to...

CVE-2025-67035

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys,...

PT-2026-24576

CVE-2026-20892 Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands. https://t.co/kFNHR6JAmT...

EUVD-2026-10571

CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of...

EUVD-2026-10572

CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of...

CVE-2026-25836

An improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP...

CVE-2026-22628

An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file...

CVE-2025-66178

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated...