Total
6747 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71966 | 2 Cyberpanel, Usmannasir | 2 Cyberpanel, Cyberpanel | 2026-08-14 | 8.8 High |
| CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function. | ||||
| CVE-2026-71956 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges. | ||||
| CVE-2026-71955 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71954 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71953 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges. | ||||
| CVE-2026-71951 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges. | ||||
| CVE-2026-71950 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges. | ||||
| CVE-2026-71949 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71948 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges. | ||||
| CVE-2026-71946 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges. | ||||
| CVE-2026-71945 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges. | ||||
| CVE-2026-71944 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-14 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges. | ||||
| CVE-2026-69096 | 1 Openwrt | 1 Luci | 2026-08-14 | 8.8 High |
| OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory. | ||||
| CVE-2026-67325 | 3 Gitpython-developers, Gitpython Project, Redhat | 3 Gitpython, Gitpython, Hummingbird | 2026-08-14 | 8.8 High |
| GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands. | ||||
| CVE-2026-67324 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-08-14 | 9.8 Critical |
| GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51. | ||||
| CVE-2026-53790 | 2 Rsync Project, Samba | 2 Rsync, Rsync | 2026-08-14 | 8.1 High |
| rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user. | ||||
| CVE-2026-48554 | 1 Nagios | 2 Nagios Core, Nagios Xi | 2026-08-14 | 7.5 High |
| Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line. | ||||
| CVE-2026-48553 | 1 Nagios | 2 Nagios Core, Nagios Xi | 2026-08-14 | 7.5 High |
| Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command. | ||||
| CVE-2026-14863 | 1 Filerun | 1 Filerun | 2026-08-14 | 8.8 High |
| FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation. | ||||
| CVE-2026-60121 | 2 Flamingo Project, Vitec | 2 Flamingo, Flamingo | 2026-08-14 | 9.8 Critical |
| Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo. | ||||