40998 matches found
EulerOS Virtualization 2.13.0 : samba (EulerOS-SA-2026-3237)
According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1 . An authenticated adjacent attacker with administrative access can store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
CVE-2026-16348
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
EUVD-2026-65059
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-76072
Continue CLI through 1.5.47 uses an incomplete denylist in evaluateTerminalCommandSecurity.ts as its sole barrier against destructive shell commands in headless and auto modes. The dangerous-path check covers only /, ~, /usr, /etc, /bin, and /sbin, leaving paths like /home, /root, /var, /opt, and...
CVE-2026-76072 Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
EUVD-2026-65007
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...
CVE-2026-16348
TP-Link Archer BE800 V1 is affected by an authenticated command injection in its VPN connection handling. An attacker with administrative access can inject shell metacharacters via the VPN connection to execute arbitrary system commands with root privileges . Successful exploitation may enable pe...
V8-sandbox-escape-PoC-
V8 Sandbox Escape PoC ⚠️ CRITICAL SECURITY WARNING ⚠️...
MAL-2026-14430 Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...
Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...
Exploit for Command Injection in Apache Ranger
CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS comma...
CVE-2026-76055
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...
CVE-2026-65611
A flaw was found in nnn, a file manager. This vulnerability, known as Shell Command Injection, allows an attacker to execute arbitrary commands. By creating a specially crafted directory name containing shell syntax on a shared filesystem, removable media, or within an extracted archive, an...
tplink-archer-root-exploit
TP-Link Archer AX73 / AX10 — Root Shell Exploit Auto-Mail L...
CVE-2026-76055
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...
CVE-2026-76055
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem...