2556040 matches found
PT-2026-80985
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...
CVE-2025-26238
In D-Link DI-8100G 17.12.20A1, the flag parameter in mspinfo can be exploited to execute arbitrary code...
MiracleLinux 9 : freerdp-2.11.7-7.el9_8.5 (AXSA:2026-1629:26)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1629:26 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async...
PT-2026-80994
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp info can be exploited to execute arbitrary code...
PT-2026-80940
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...
PT-2026-80993
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
MiracleLinux 9 : sg3_utils-1.47-10.el9_8.1 (AXSA:2026-1623:02)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1623:02 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability in the import_link() function. An attacker with valid credentials can leverage this flaw to delete arbitrary files on the system. No CVSS score, exploitation evidence, or specific remediation version is provided in the a...
RHEL 7 : webkitgtk4 (RHSA-2026:58564)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58564 advisory. WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3. Security...
PT-2026-81074
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability...
PT-2026-80947
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted inpu...
PT-2026-80976
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this...
GNU Emacs: Arbitrary code execution
Background GNU Emacs is the extensible, customizable, self-documenting real-time display editor. Description A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details. Impact An attacker could achieve arbitrary code execution by tricking a use...
Grafana OSS: Stored XSS via external Alertmanager generatorURL
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL . The attacker is authorized to create the alert, but not to execute script in another user’s Grafana session. Grafana renders...
PT-2026-80958
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...
CVE-2025-26238
D-Link DI-8100G firmware version 17.12.20A1 contains a vulnerability in the flag parameter of the msp_info function, which can be exploited to achieve arbitrary code execution . No patched version or vendor workaround is provided in the available documents. A research writeup and potential proof-...
CVE-2022-30983
CVE-2022-30983 is a cross-site scripting (XSS) vulnerability in the Support chatbot component of Nopaperforms Niaa-Chatbot , affecting versions through 2022-05-17 . Remote attackers can inject arbitrary web script or HTML via the Enter email parameter. No patch version, workaround, or exploitatio...
CVE-2025-26237
D-Link DI-7001 MINI_5G (firmware 19.10.31A1 ) contains a code execution vulnerability in the flag parameter of the msp_info handler. An attacker can exploit this flaw to execute arbitrary commands on the device. The provided documents do not specify the exact injection mechanism (e.g., shell meta...
RHEL 9 : python-urwid (RHSA-2026:58952)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58952 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
