Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.125 | 6,0 % |
| <10 % | 343.452 | 92,9 % |
CVE-2016-0763 | Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext access control (RHSA-2016:1087 / Nessus ID 88936)
A vulnerability was found in Apache Tomcat 7.0/8.0/9.0. It has been rated as critical. Affected by this vulnerability is the function ResourceLinkFactory.setGlobalContext. Performing a manipulation results in improper access controls. This
CVE-2016-0714 | Oracle Communications 12.x Policy Management access control (Nessus ID 90274 / ID 350024)
A vulnerability categorized as critical has been discovered in Oracle Communications 12.x. This impacts an unknown function of the component Policy Management. Executing a manipulation can lead to improper access controls. This vulnerabilit
CVE-2016-0706 | Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure (RHSA-2016:1087 / Nessus ID 88935)
A vulnerability was found in Apache Tomcat 6.0/7.0/8.0/9.0 and classified as problematic. This affects an unknown function of the component StatusManagerServlet. The manipulation results in information disclosure. This vulnerability was nam
CVE-2016-0494 | Oracle Java SE 6u105/7u91/8u66 2D memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability, which was classified as very critical, has been found in Oracle Java SE 6u105/7u91/8u66. Affected by this issue is some unknown functionality of the component 2D. The manipulation leads to memory corruption. This vulnerabil
CVE-2016-0483 | Oracle Java SE 6u105/7u91/8u66 AWT memory corruption (Nessus ID 88060 / ID 350048)
A vulnerability has been found in Oracle Java SE 6u105/7u91/8u66 and classified as very critical. This vulnerability affects unknown code of the component AWT. This manipulation causes memory corruption. This vulnerability is registered as
CVE-2016-0475 | Oracle Java SE 8u66 Libraries memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 8u66 and classified as critical. This issue affects some unknown processing of the component Libraries. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2016-0
CVE-2016-0466 | Oracle Java SE 6u105/7u91/8u66 JAXP denial of service (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been declared as problematic. The affected element is an unknown function of the component JAXP. Executing a manipulation can lead to denial of service. This vulnerability
CVE-2016-0448 | Oracle Java SE 6u105/7u91/8u66 JMX information disclosure (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been rated as problematic. The impacted element is an unknown function of the component JMX. The manipulation leads to information disclosure. This vulnerability is traded
CVE-2016-0402 | Oracle Java SE 6u105/7u91/8u66 Networking memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been classified as problematic. Impacted is an unknown function of the component Networking. Performing a manipulation results in memory corruption. This vulnerability is r
CVE-2016-0055 | Microsoft Office up to 2016 memory corruption (MS16-015 / Nessus ID 88647)
A vulnerability was found in Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1/2016. It has been declared as critical. This impacts an unknown function. Such manipulation leads to memory corruption. This vulnerability is referenced as
CVE-2016-0035 | Microsoft Excel up to 2016 Office Document memory corruption (MS16-004 / Nessus ID 87882)
A vulnerability labeled as critical has been found in Microsoft Excel up to 2016. The impacted element is an unknown function of the component Office Document Handler. Executing a manipulation can lead to memory corruption. This vulnerabili
CVE-2016-0012 | Microsoft Office up to 2016 ASLR information disclosure (MS16-004 / Nessus ID 87882)
A vulnerability marked as critical has been reported in Microsoft Office up to 2016. Impacted is an unknown function of the component ASLR. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2
CVE-2016-0011 | Microsoft SharePoint Foundation 2013 SP1 Access Control Policy cross site scripting (MS16-004 / Nessus ID 87882)
A vulnerability labeled as problematic has been found in Microsoft SharePoint Foundation 2013 SP1. This issue affects some unknown processing of the component Access Control Policy. Such manipulation leads to cross site scripting. This vuln
CVE-2016-0010 | Microsoft Office up to 2016 Office Document memory corruption (MS16-004 / Nessus ID 87882)
A vulnerability identified as critical has been detected in Microsoft Office up to 2016. This vulnerability affects unknown code of the component Office Document Handler. This manipulation causes memory corruption. This vulnerability is reg
CVE-2022-46639 | Correos Prestashop 1.7.x descarga_etiqueta.php path traversal (EUVD-2022-49443)
A vulnerability labeled as critical has been found in Correos Prestashop 1.7.x. This affects an unknown function of the file descarga_etiqueta.php. Such manipulation leads to path traversal. This vulnerability is traded as CVE-2022-46639. A
CVE-2022-46637 | Prolink PRS1841 Telnet/FTP hard-coded credentials (ID 170342 / EUVD-2022-49441)
A vulnerability classified as critical was found in Prolink PRS1841. Affected by this vulnerability is an unknown functionality of the component Telnet/FTP. Such manipulation leads to hard-coded credentials. This vulnerability is documented
CVE-2022-46634 | TOTOLINK A7100RU 7.4cu.2313_B20191024 setting/setWiFiWpsCfg wscDisabled command injection (EUVD-2022-49438)
A vulnerability identified as critical has been detected in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this issue is some unknown functionality of the file setting/setWiFiWpsCfg. Performing a manipulation of the argument wscDisabled
CVE-2022-46631 | TOTOLINK A7100RU 7.4cu.2313_B20191024 setting/setWiFiSignalCfg wscDisabled command injection (EUVD-2022-49435)
A vulnerability categorized as critical has been discovered in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this vulnerability is an unknown functionality of the file setting/setWiFiSignalCfg. Such manipulation of the argument wscDisa
CVE-2022-46610 | 72crm 9.0 unrestricted upload (Issue 36 / EUVD-2022-49414)
A vulnerability, which was classified as critical, was found in 72crm 9.0. This affects an unknown function. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2022-46610. The attack can be execut
CVE-2022-46601 | TRENDnet TEW755AP 1.13B01 icp_setbg_img setbg_num stack-based overflow (EUVD-2022-49405)
A vulnerability identified as critical has been detected in TRENDnet TEW755AP 1.13B01. This vulnerability affects the function icp_setbg_img. The manipulation of the argument setbg_num leads to stack-based buffer overflow. This vulnerabilit
CVE-2022-46599 | TRENDnet TEW755AP 1.13B01 icp_setlogo_img setlogo_num stack-based overflow (EUVD-2022-49403)
A vulnerability was found in TRENDnet TEW755AP 1.13B01. It has been rated as critical. Affected by this issue is the function icp_setlogo_img. Performing a manipulation of the argument setlogo_num results in stack-based buffer overflow. Thi
Silent Lynx nutzt WinRAR-Fehler für Reverse-Shell-Zugriff in CIS-Regierungen
LONDON (IT BOLTWISE) – Ein Angreifer namens Silent Lynx soll über mehrere Jahre gezielt Regierungsorganisationen im CIS-Raum kompromittiert haben. In der aktuellen Vorgehensweise kombiniert das Cluster Makro-Dokumente, PS2EXE-Downloader und
CVE-2019-8457 | Oracle Berkeley DB up to 18.1 Data Store out-of-bounds (Nessus ID 236583 / ID 197482)
A vulnerability was found in Oracle Berkeley DB up to 18.1. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Data Store. The manipulation leads to out-of-bounds read. This vulnerab
CVE-2019-12904 | Libgcrypt 1.8.4 AES cryptographic issue
A vulnerability identified as critical has been detected in Libgcrypt 1.8.4. Affected by this vulnerability is an unknown functionality of the component AES. Performing a manipulation results in cryptographic issues. This vulnerability is c
CVE-2019-12900 | Oracle Database Server up to 19c bzip2 out-of-bounds write (Nessus ID 210436)
A vulnerability was found in Oracle Database Server 11.2.0.4/12.1.0.2/12.2.0.1/18c/19c. It has been classified as critical. This vulnerability affects unknown code of the component bzip2. This manipulation causes out-of-bounds write. The id
CVE-2018-20843 | Oracle Hospitality RES 3700 up to 5.7.6 LibExpat denial of service (Nessus ID 213995)
A vulnerability classified as critical has been found in Oracle Hospitality RES 3700 up to 5.7.6. The affected element is an unknown function of the component LibExpat. Performing a manipulation results in denial of service. This vulnerabil
CVE-2026-104800 | The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it possible for unauthenticated attackers to exe
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verific
CVE-2026-109110 | A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit
CVE-2026-108918 | A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintaine
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. Th
CVE-2026-108916 | A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer support
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carr
CVE-2026-108896 | A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack ca
CVE-2026-108804 | A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability ex
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service result
CVE-2026-108540 | A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remo
CVE-2026-108161 | FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename
CVE-2026-55797 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repos
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git reposi
CVE-2026-107780 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single q
CVE-2026-106126 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
CVE-2026-84278 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, res
CVE-2026-107704 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enable
CVE-2026-107703 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a
CVE-2026-107699 | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' t
CVE-2026-94586 | A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user wit
CVE-2026-94581 | An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on th
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system c
CVE-2026-87666 | An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submittin
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration downloa
CVE-2026-106059 | GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a f
CVE-2026-102160 | An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected servic
CVE-2026-79802 | A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with elevated privileges on the affected host.
A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with ele
CVE-2026-101207 | Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with r
CVE-2026-91140 | An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAP
CVE-2026-105487 | A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name re
CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the
CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability
CVE-2026-88396 | ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploa
CVE-2026-105134 | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve this issue. Upgrading the affected component is advised.
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os
CVE-2026-104019 | OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow an authenticated remote user with project contributor permissions to execute arbitrary commands in another project member's Studio Space and obtain that member's
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.
CVE-2026-104286 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow
CVE-2026-84682 | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as r
CVE-2026-12541 | A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell comma
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and t
CVE-2026-12540 | A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitra
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. Whil
CVE-2026-12405 | A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during th
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the appl