CVE-2026-44713: Improper Neutralization of Special Elements used in an OS Command

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to popen. Because the value is placed insi...

EUVD-2026-27394

A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH...

CVE-2026-7865 Hidden Console Command

A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH...

CVE-2026-7865

A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH...

CVE-2026-7865

The CVE-2026-7865 entry describes a vulnerability in Crestron devices where a hidden console command can be exploited to perform command injection by passing control characters to the second argument of a popen call. Affected software is the Crestron SSH console exposed on eligible devices; the u...

CVE-2026-7865 Hidden Console Command

A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH...

CVE-2026-7865: Improper Neutralization of Argument Delimiters in a Command

A hidden console command is vulnerable to command injection flaw when control characters are passed to its second argument. A third party researcher Eugene Lim had discovered vulnerability in the way console command passes to a popen function call. Attackers with authenticated access to SSH...

PT-2026-37084

Name of the Vulnerable Software and Affected Versions Crestron devices affected versions not specified Description A hidden console command contains a command injection flaw occurring when control characters are passed to its second argument. This issue exists in the way the console command is...

CVE-2026-41923

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit...

CVE-2026-41923

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit...

PT-2026-36911

Name of the Vulnerable Software and Affected Versions WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 Description An OS command injection issue exists in the 'internet.cgi' binary. Unauthenticated remote attackers can execute arbitrary shell commands by injecting malicious input into the...

CVE-2026-41923: Improper Neutralization of Special Elements used in an OS Command

WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter. Attackers can exploit...

EUVD-2026-23321

sagredo qmail before 2026.04.07 allows tlsquit remote code execution because of popen in notlshostsauto in qmail-remote.c...

CVE-2026-41113

sagredo qmail before 2026.04.07 allows tlsquit remote code execution because of popen in notlshostsauto in qmail-remote.c...

CVE-2026-41113

sagredo qmail before 2026.04.07 allows tlsquit remote code execution because of popen in notlshostsauto in qmail-remote.c...

CVE-2026-41113

CVE-2026-41113 affects sagredo qmail prior to 2026.04.07. Root cause: qmail-remote.c uses popen in notlshosts_auto, enabling remote code execution (tls_quit) over the network. Impact: high on confidentiality, integrity, and availability; attack vector is network with no privileges and no user int...

PT-2026-33371

Name of the Vulnerable Software and Affected Versions sagredo qmail versions prior to 2026.04.07 Description Remote code execution is possible due to the use of the popen function within the notlshosts auto function in the qmail-remote.c file, which can be triggered via the 'tls quit' command...

Qmail 安全漏洞

Qmail is a mail transfer agent software developed by Roberto Puzzanghera individually, written in C language and running on Unix-like operating systems. Versions of Qmail before 2026.04.07 contained security vulnerabilities; these vulnerabilities stemmed from the use of popen in the notlshostsaut...

CVE-2026-41113: Improper Neutralization of Special Elements used in an OS Command

sagredo qmail before 2026.04.07 allows tlsquit remote code execution because of popen in notlshostsauto in qmail-remote.c...

CVE-2026-29955

The /registercrd endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection. The component uses subprocess.Popen with shell=True parameter to execute shell commands, and the user-supplied chartName parameter is directly concatenated into the command string...