CVE-2026-45746

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend...

CVE-2026-45777: Improper Neutralization of Special Elements used in an OS Command

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attack...

PT-2026-47019

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The File Manager functionality contains a Broken Access Control issue resulting from...

Termix 安全漏洞

Termix is a server management platform developed by Karmaa’s individual developers. Versions of Termix prior to 2.3.2 contained security vulnerabilities. These vulnerabilities stemmed from improper validation of the sessionId parameter by the file manager’s functionality. The identifier controlle...

Termix 安全漏洞

Termix is a server management platform developed by Karmaa’s individual developers. Versions of Termix prior to 2.3.2 contained security vulnerabilities. These vulnerabilities stemmed from the insecure handling of path parameters by the GET /ssh/filemanager/ssh/resolvePath endpoint, which caused...

CVE-2026-10872

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function startvpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used...

CVE-2026-45431 Command Injection Vulnerability in GX Earth ONT Models

This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its web management interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary and executing OS commands on the targeted...

CVE-2026-3820

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process...

The vulnerability of the UniFi OS Server network management center, related to insufficient validation of input data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the UniFi OS Server network management center is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

The vulnerability of the formWPS() function in the /goform/formWPS file of TRENDnet TEW-432BRP microprogramming router software allows a hacker to execute arbitrary commands.

The vulnerability of the formWPS function in the /goform/formWPS file of TRENDnet TEW-432BRP microprogramming router software is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow a remote attacker to execute arbitrar...

The vulnerability of the formSetRoute() function in the /goform/formSetRoute file of the TRENDnet TEW-432BRP router microprogramming system, which allows a hacker to execute arbitrary commands.

The vulnerability of the formSetRoute function in the /goform/formSetRoute file of the TRENDnet TEW-432BRP router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability may allow a remote attacker to...

The vulnerability of the developer tool “1C:Library of Standard Subsystems” arises from the failure to take measures to neutralize special elements, allowing attackers to execute arbitrary commands on behalf of the server user.

The vulnerability of the developer tool “1C:Standard Subsystems Library” relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the server user remotely...

The vulnerability of the sprintf() function in the /httpddebug.asp file of the D-Link DI-7001 MINI router’s microprogramming system allows a hacker to cause a service failure or execute arbitrary commands.

The vulnerability of the sprintf function in the /httpddebug.asp file of the D-Link DI-7001 MINI router’s microprogramming system is related to the execution of operations outside the buffer in memory when processing the time parameter. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the UniFi OS Server network management center, related to insufficient validation of input data, allows a perpetrator to execute arbitrary commands.

The vulnerability of the UniFi OS Server network management center is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

CVE-2026-35482

CVE-2026-35482 affects alf.io prior to version 2.0-M5-2606. A sandbox escape in the extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The sandbox uses a Rhino environment to run restricted JavaScript, but an unguarded injec...

OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username

A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the '%' character in...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

MAL-2026-5151 Malicious code in parsimonius (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a5ab85a46a37da928774b1885049b71d40d675c54683b13711f4e371d932394a Clone of a legitimate package with an added RAT running through a Telegram bot. It can e.g. exfiltrate env variables and execute remote commands. The malicious...

PT-2026-45723

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu2016.437.295020260327 105545 Description Server-Side Template Injection SSTI occurs when an unauthenticated attacker injects arbitrary template expressions into the server, which are then executed. This...

The vulnerability of the formWlanSetup() function in TRENDnet TEW-432BRP router software allows a hacker to execute arbitrary commands.

The vulnerability of the formWlanSetup function in TRENDnet TEW-432BRP router software lies in the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...