CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-91853 TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

EUVD-2026-78822

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

CVE-2026-91853

TOTOLINK X5000R (firmware 9.1.0cu.2089_B20211224 ) contains an OS command injection vulnerability in the Export Ovpn Handler . The exportOvpn function in /cgi-bin/cstecgi.cgi fails to properly sanitize the filetype argument, allowing a remote attacker with low privileges to inject and execute arb...

CVE-2026-91853 TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

Vulnerability handling in Palo Alto Networks PAN-OS

Palo Alto Networks has identified a vulnerability in the PAN-OS software, specifically related to VM-Series and PA-Series firewalls, as well as the Panorama management software. The vulnerability involves a buffer overflow in the XML processing function of PAN-OS. Unauthorized attackers with...

ROOT-OS-ALPINE-317-CVE-2026-31790 CVE-2026-31790 in openssl - Patched by Root

Root has patched CVE-2026-31790 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

CVE-2026-89308

An unauthenticated OS command injection vulnerability in the ping.php endpoint of TrxTimeATTENDANCE (a time-attendance application by Trexom ) allows remote attackers to execute arbitrary commands on the underlying operating system, achieving remote code execution (RCE) . The vulnerability is rat...

EUVD-2026-78440

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution...

CVE-2026-47424

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

EUVD-2026-78367

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-47424

OpenAM (Open Access Management) Community Edition through 16.0.6 contains a Protection Mechanism Failure (CWE-693) in the GroovySandboxValueFilter component of its server-side scripting sandbox. An authenticated user with the ability to create or edit scripts in an executed context — such as a su...

CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

EUVD-2026-78364

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CVE-2026-19515

CVE-2026-19515 is an OS command injection vulnerability in the WSO2 Integrator MI VS Code extension . The extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources , allowing a crafted project to inject and execute...

CVE-2026-19515 OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...