Zyxel EX3301-T0 操作系统命令注入漏洞

The Zyxel EX3301-T0 is a security routing gateway produced by the Chinese company Zyxel. Versions of the Zyxel EX3301-T0 prior to 5.50ABVY.7C0 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the log file download function, where command...

Intelbras TIP 635G 操作系统命令注入漏洞

The Intelbras TIP 635G is an IP phone produced by the Brazilian company Intelbras. Version 1.12.3.5 of the Intelbras TIP 635G contains a vulnerability related to operating system command injection. This vulnerability stems from a flaw in the Ping Handler component, which may allow for OS command...

PT-2026-21645

Name of the Vulnerable Software and Affected Versions Zyxel VMG3625-T50B firmware versions through 5.50ABPM.9.7C0 Description A post-authentication command injection exists in the TR-369 certificate download CGI program. An authenticated attacker with administrator privileges could execute...

yt-dlp 操作系统命令注入漏洞

yt-dlp is a branch of youtube-dl based on the now-deprecated youtube-dlc. Versions of yt-dlp from 2023.06.21 to 2026.02.21 had an operating system command injection vulnerability. This vulnerability occurred when using the --netrc-cmd command-line option, which might allow command injection,...

Mozilla Thunderbird < 140.8

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-17 advisory. - Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147...

CVE-2026-3040

CVE-2026-3040 affects DrayTek Vigor 300B (up to version 1.5.1.6) in the Web Management Interface, specifically the cgiGetFile function in /cgi-bin/mainfunction.cgi/uploadlangs. The File argument manipulation leads to OS command injection. Reports indicate remote initiation is possible and that an...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.5)

The version of AOS installed on the remote host is prior to 7.3.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.5 advisory. - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library...

CVE-2025-70328

TOTOLINK X6000R v9.4.0cu.1498B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The hosttime parameter is retrieved via sub40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the...

CVE-2026-2944 Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection

A security flaw has been discovered in Tosei Online Store Management System ネット店舗管理システム 1.01. Affected is the function system of the file /cgi-bin/monitor.php of the component HTTP POST Request Handler. Performing a manipulation of the argument DevId results in os command injection. The attack ma...

Vaelsys V4 操作系统命令注入漏洞

Vaelsys V4 is an artificial intelligence video analysis platform developed by the Spanish company Vaelsys. Version 4.1.0 of Vaelsys V4 contains a vulnerability related to operating system command injection. This vulnerability stems from incorrect handling of the parameter xajaxargs in the...

Photon OS 5.0: Linux PHSA-2026-5.0-0770

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0770. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-27487 OpenClaw: Prevent shell injection in macOS keychain credential write

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data,...

OpenClaw 操作系统命令注入漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability stems from a keychain credential refresh shell command constructed on macOS failing to properly filter constructed command special...

CVE-2026-2818

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only...

CVE-2026-2847

A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument IspName results in os command injection. The attack can be launched remotely. The explo...

trusted AMD DoS

The vulnerability of the trusted operating system for AMD graphics processors’ microprogramming software is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause service failures...

Direct Rendering Infrastructure Heap Buffer Overflow DoS

The vulnerability of the tglgetbwinfo function in the drivers/gpu/drm/i915/display/intelbw.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux operating system, involves the dereferencing of a NULL pointer. Exploiting this vulnerability could allow an attacker to cause ...

Atheros Wireless Driver Heap Buffer Overflow DoS

The vulnerability of the ath11kpciwrite32 function in the drivers/net/wireless/ath/ath11k/pci.c file of the Atheros/Qualcomm wireless adapter support driver for the Linux operating system is related to improper cleanup or release of resources. Exploiting this vulnerability can allow an attacker t...

AIX : Multiple Vulnerabilities (IJ57162)

The version of AIX installed on the remote host is prior to APAR IJ57162. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ57162 advisory. - A flaw was identified in the X.Org X server's X Keyboard Xkb extension where improper bounds checking in the XkbSetCompatMap...

Liquid Prompt 操作系统命令注入漏洞

Liquid Prompt is an open-source prompt tool developed by Liquid Prompt. Liquid Prompt has a vulnerability related to operating system command injection. This vulnerability arises from command injection when processing specially crafted branch names, which may lead to code execution...