CVE-2026-101859

A vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 within the OpenVPN Configuration Handler component. The root cause is an os command injection vulnerability in the escapeshellcmd function of the ajax/openvpn/del_ovpncfg.php file. Attackers can exploit this by manipulating the cf...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

EUVD-2026-88603

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101858

A flaw in RaspAP raspap-webgui versions up to 3.5.5 allows for OS command injection . The vulnerability exists within the SSID Processing component, specifically in the WiFiManager::writeWpaSupplicant function located in the file src/RaspAP/Networking/Hotspot/WiFiManager.php. Attackers can achiev...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

EUVD-2026-88601

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-102437: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

PT-2026-102949

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A stack-based buffer overflow occurs in the DHCP fingerprinting daemon fingerd. An unauthenticated attacker with adjacent network access can execute arbitrary code or cause the...

PT-2026-102435

Name of the Vulnerable Software and Affected Versions Netcore NAP930 version 0.1.241010.141410 Description Remote OS command injection is possible within the Network Tools CGI component. The issue exists in the eval function of the '/www/cgi-bin/network tools' endpoint, where improper handling of...

PT-2026-102420

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the SSID Processing component. The issue occurs within the WiFiManager::writeWpaSupplicant function located in the...

CVE-2026-100292: Improper Neutralization of Special Elements used in an OS Command

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-102828: Improper Neutralization of Special Elements used in an OS Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer. .cmd as unsafe configuration. An application that passes...

CVE-2026-102829: Improper Neutralization of Special Elements used in an OS Command

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv drops the value before vulnerabilityCheck can classify it a...

PT-2026-102951

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description An uncontrolled resource consumption issue exists in the login process of the wgagent component. A remote, unauthenticated attacker can trigger a denial of service by sending a specially...

PT-2026-102520

Name of the Vulnerable Software and Affected Versions DeepSeek-Reasonix Studio versions prior to 2.21.0 DeepSeek Reasonix npm versions prior to 1.39.3 Description An OS command injection flaw exists in the internal/gitcmd component of DeepSeek-Reasonix Reasonix Studio. A local attacker who contro...

PT-2026-102948

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A stack-based buffer overflow in the spamBlocker spamd service allows an authenticated attacker with administrator privileges to crash the service or potentially execute...

CVE-2026-101858: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

PT-2026-102946

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description A path traversal issue in the WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted managemen...