SUSE-SU-2026:2350-1 Security update for wicked

This update for wicked fixes the following issues: - CVE-2026-44932: Fixed indirect remote shell command injection via unsanitized DHCP options bsc1265221...

SUSE-SU-2026:2349-1 Security update for wicked

This update for wicked fixes the following issue - CVE-2026-44932: indirect remote shell command injection via unsanitized DHCP options bsc1265221. Changes for wicked: - Update to version 0.6.79 - Fix to escape single-quotes in leaseinfo dump output used by the wicked test dhcp4 and wicked test...

CLSA-2026-1781101271 samba: Fix of 2 CVEs

CVE-2026-3012: do not trust CA certificates fetched over HTTP in the certificate auto-enrollment GP extension; use only LDAP-derived certificates and skip CAs with no cACertificate attribute - CVE-2026-4408: escape shell metacharacters in the client-controlled username before substituting it into...

samba: Remote Code Execution in SAMR

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...

CVE-2026-46746

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 6. The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when...

CVE-2025-66273

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

CVE-2026-24719 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

EUVD-2025-210100

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

CVE-2025-66279

CVE-2025-66279 is a command-injection vulnerability affecting several QNAP OS versions. The issue allows an attacker who already has an administrator account to execute arbitrary commands remotely. Affected products/versions include QTS 5.2.9.3410 build 20260214 and later; QuTS hero h5.2.9.3410 b...

CVE-2025-66273 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Exploit for CVE-2026-48732

CVE-2026-48732: Warp Remote SSH cwd Command Injection PoC...

QNAP Systems QTS and QNAP Systems QuTS operating system command injection vulnerabilities

QNAP Systems QTS and QNAP Systems QuTS hero are software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. Both products have an operating system command injection vulnerability. This vulnerability arises from command injections, whic...

CVE-2025-66279: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

CVE-2026-10727

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root...

CVE-2026-46746

Vulnerability summary (CVE-2026-46746): In Siemens SINEC INS, all versions prior to V1.0 SP2 Update 6 expose a flaw in the /api/sftp/uploadFiles endpoint. The app does not properly sanitize user input, enabling injection of shell command payloads via crafted directory names. These payloads are st...

EUVD-2026-35383

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 6. The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when...

injection_exploit

Injection Exploit SQLi 6 engines + SSTI 11 engines — GET/...

D-Link DWR-M920 Router Sub_412DA0 Function Command Injection

The vulnerability of the sub412DA0 function in the /boafrm/formIMEISetup file of the D-Link DWR-M920 router’s microprogramming system is related to the lack of measures taken to protect data at the control level. Exploiting this vulnerability could allow a malicious actor to inject arbitrary...

PT-2026-47814

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi 370 series versions prior to V12.1.2.7 Description A security issue exists that allows an attacker capable of intercepting and tampering with traffic between the router and the Internet to execute commands on the device. This occu...

GL.iNet GL-MT3000 Router Arbitrary Command Injection

The vulnerability of the FUN0042e200 function in the /cgi-bin/glc module of the GL.iNet GL-MT3000 router’s microprogramming system is related to the failure to implement measures to neutralize specific elements. Exploiting this vulnerability could allow a malicious actor to inject arbitrary...