CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...

EUVD-2026-76130

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...

CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are vulnerable to an unauthenticated OS command injection via the sync_server daemon on TCP port 13136 . The root cause is that the daemon interpolates attacker-controlled filename input containing shell metacharacters in...

CVE-2026-89010 WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...

CVE-2026-89010 WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...

CVE-2026-85979 Command Injection in Puppet Enterprise

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

CVE-2026-85979

Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...

PT-2026-102974

Name of the Vulnerable Software and Affected Versions adm-zip version 0.6.0 Description An issue exists where the software applies Unix permission bits from a zip entry directly to an extracted file using the fs.chmodSync function when the keepOriginalPermission flag is set to true in the...

CVE-2026-65639

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-65639

ConfigServer Security & Firewall (CSF) is vulnerable to OS command injection in its advanced-rule parser . An attacker who controls a configured allow/deny feed can inject commands that execute with root privileges , due to insufficient validation of feed-supplied rule data. The vulnerability aff...

CVE-2026-65639

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

EUVD-2026-75597

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-88273

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

CVE-2026-88277

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root...

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

EUVD-2026-75316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88277

GeoVision GV-LPC2211 version 1.13 is affected by a command injection vulnerability in its ONVIF interface. An authenticated ONVIF user can inject shell commands via the ConsumerReference.Address field, leading to arbitrary command execution with root privileges . The vulnerability is network-reac...

CVE-2026-88277 GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root...

CVE-2026-88277 GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root...