CVE-2026-54796

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-54796

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-78359

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this flaw...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

vBulletin 5.0.0-5.5.4 - Remote Command Execution

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widgetphp routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

CVE-2026-17110

IBM i 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-17110, allowing a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management. Affected IBM i release levels are 7.6/7.5/7.4/7.3 with 5770-SS1; remediation via PTFs SJ10867/...

SPIP - Remote Command Execution

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. id: CVE-2023-27372 info: name: SPIP - Remote Command Execution author: DhiyaneshDK,nuts7 severity: critical description: ...

SonicWall SMA1000 Server-Side Request Forgery / Remote Command Execution

This Metasploit module exploits a server-side request forgery vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to...

MAL-2026-13687 Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

EUVD-2026-55217

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

Astra Linux – Vulnerability in qBittTorrent

All versions of the qBittorrent client up to 4.5.5 use default credentials when the web user interface is enabled. Administrators are not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

EUVD-2026-54829

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and...

CVE-2026-71991

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet...

CVE-2026-71991

Affected product: MSI Radix AXE6600 router (firmware v781521). Vulnerability: Command injection in the TelnetSSH function used for Telnet configuration, enabling remote command execution on the device. Impact: Attacker can run arbitrary commands with root privileges via the Telnet configuration i...

CVE-2026-71989 MSI Radix AXE6600 v781521 Command Injection via porTrigger function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious command...

CVE-2026-71987

CVE-2026-71987 affects MSI Radix AXE6600 firmware v781521. A command injection flaw exists in the alg function that allows remote attackers to execute arbitrary commands with root privileges on the device. The vulnerability is exploitable over the network with low attack complexity and no authent...