CVE-2026-71916 DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger th...

CVE-2026-71908

Multiple DrayTek VigorAP models are affected by an OS command injection vulnerability in the mesh_start_speed_test function, caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before they are passed to a command execution context. A remote attacker with valid adm...

CVE-2026-71907

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function, caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker with valid administrative credentials for the device's web management interface can craft inp...

EUVD-2026-64964

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted...

CVE-2026-71905 DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted...

CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

EUVD-2026-64963

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — OnePlus Locked Bootloader Jailbreak Kernel exploi...

EUVD-2026-64757

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

V2E_artifacts

CVE-2021-43267 Work Artifacts This bundle preserves the curre...

CVE-2026-76156

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-18269

Kenwood DNR1007XR tchdrbytestreamread Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specif...

EUVD-2026-63420

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged...

CVE-2026-18271

Kenwood DNR1007XR is affected by a heap-based buffer overflow in the vCardParser class. The root cause is the lack of proper validation of a user-supplied string before it is copied into a heap-allocated buffer. A physically present attacker can exploit this flaw without authentication to achieve...

EUVD-2026-63413

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-18267 Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw...

PT-2026-79033

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A time-of-check to time-of-use TOCTOU race condition exists, which could allow a local attacker to gain root privileges. A TOCTOU race condition occurs when a...

EUVD-2026-62514

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication...

CVE-2026-71961 Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...