CVE-2026-76582

TRENDnet TEW-821DAP firmware 2.2.01b05 passes the unsanitized ipaddr argument from /cgi-bin/ping.cgi to popen/system in the ssi component, enabling remote command injection; a proof-of-concept exploit is publicly available on GitHub. No patch or workaround is mentioned in the provided documents.

EUVD-2026-62852

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...

CVE-2026-76582 TRENDnet TEW-821DAP ssi ping.cgi system command injection

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected is the function popen/system of the file /cgi-bin/ping.cgi of the component ssi. Executing a manipulation of the argument ipaddr can lead to command injection. It is possible to launch the attack remotely. The exploit has...

CVE-2026-69220 vulnerabilities

Vulnerabilities for packages: conductor, zipkin, druid, cassandra-reaper, thingsboard, conductor-fips, nuxeo, traccar-fips, traccar...

CVE-2026-69219 vulnerabilities

Vulnerabilities for packages: conductor, zipkin, druid, cassandra-reaper, thingsboard, conductor-fips, nuxeo, traccar-fips, traccar...

CVE-2026-63337 vulnerabilities

Vulnerabilities for packages: conductor, zipkin, druid, cassandra-reaper, thingsboard, conductor-fips, nuxeo, traccar-fips, traccar...

GO-2026-4950 vulnerabilities

Vulnerabilities for packages: dapr-fips, dapr...

CVE-2026-69220 vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, zipkin, thingsboard...

CVE-2026-63335 vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, zipkin, thingsboard...

GHSA-68MJ-5WR7-6FGG vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, zipkin, thingsboard...

CVE-2026-69219 vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, zipkin, thingsboard...

GHSA-QX7J-JV8M-FPPR vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, zipkin, thingsboard...

GHSA-FJ27-X67R-V4G5 vulnerabilities

Vulnerabilities for packages: busybox...

EUVD-2026-62848

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

CVE-2026-76574

A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersController.php of the component User Login Handler. This manipulation of the argument email causes sql injection. The attack is possible to be...

CVE-2026-68560

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-63722

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-55085

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...