EUVD-2026-85878

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95521

A command injection flaw exists in rpm when installing or rebuilding a source RPM . If the source or spec file basenames contain a %() macro construct , rpm executes attacker-controlled shell commands via popen() during the relocation of the source file list. This vulnerability allows for arbitra...

CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-96515

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise BEC operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series aroun...

Exploit for CVE-2026-96515

CVE-2026-96515: authenticated root command execution in Netlin...

CVE-2026-96515

The Netlink ICT HG323RW router is susceptible to a command injection vulnerability due to insufficient authorization and input validation controls within the diagnostic script import functionality . An authenticated attacker can exploit this by uploading and executing a specially crafted script v...

EUVD-2026-85858

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

CVE-2026-96515 Command Injection Vulnerability in Netlink ICT HG323RW Router

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

CVE-2026-96515 Command Injection Vulnerability in Netlink ICT HG323RW Router

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

CVE-2026-82077

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

EUVD-2026-85811

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

Vulnerabilities in Adobe Campaign Classic

Adobe has identified 18 critical vulnerabilities in Adobe Campaign Classic. These vulnerabilities involve code and OS command injection, SQL injection, insufficient authorization, inadequate input validation, and Server-Side Request Forgery SSRF. All 18 vulnerabilities are classified as critical,...

CVE-2026-14780

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that...

Eufy Omni C20, Omni X10 Pro

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network...

anyka-ak3918-gt111a-root-decloud

📷 Anyka AK3918E GT111A Wi-Fi PTZ Camera — Root & De-Cloud...

EUVD-2026-85791

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that...