CVE-2026-92115 | High | 8.8 | 2026-10-16 | The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value`… |
CVE-2026-55453 | Low | 3.3 | 2026-10-15 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function… |
CVE-2026-110957 | Critical | 10.0 | 2026-10-15 | A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the compone… |
CVE-2026-110536 | Critical | 10.0 | 2026-10-14 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Execu… |
CVE-2026-101216 | Medium | 6.6 | 2026-10-14 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnera… |
CVE-2026-104585 | Critical | 9.8 | 2026-10-13 | Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. |
CVE-2026-97781 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code… |
CVE-2026-96951 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security featu… |
CVE-2026-69718 | High | 7.8 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges local… |
CVE-2026-69370 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over… |
CVE-2026-109409 | Medium | 5.3 | 2026-10-13 | A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManageme… |
CVE-2026-109110 | Critical | 10.0 | 2026-10-13 | A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to… |
CVE-2026-109108 | Critical | 9.9 | 2026-10-13 | A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulati… |
CVE-2026-108918 | Critical | 10.0 | 2026-10-12 | A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE… |
CVE-2026-108917 | Critical | 10.0 | 2026-10-12 | A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipula… |
CVE-2026-108916 | High | 8.3 | 2026-10-12 | A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the ar… |
CVE-2026-108896 | Critical | 9.9 | 2026-10-12 | A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the ar… |
CVE-2026-108895 | Critical | 9.9 | 2026-10-12 | A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation o… |
CVE-2026-108894 | Critical | 9.9 | 2026-10-12 | A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component S… |
CVE-2026-108817 | Medium | 5.5 | 2026-10-12 | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/to… |
CVE-2026-108804 | Critical | 10.0 | 2026-10-12 | A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the… |
CVE-2026-108576 | Critical | 10.0 | 2026-10-11 | A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The mani… |
CVE-2026-108540 | Critical | 9.9 | 2026-10-11 | A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing… |
CVE-2026-87688 | Medium | 6.8 | 2026-10-08 | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processi… |
CVE-2026-107202 | Critical | 9.1 | 2026-10-07 | A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration fiel… |
CVE-2025-70521 | Critical | 9.8 | 2026-10-07 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user in… |
CVE-2025-70518 | Critical | 10.0 | 2026-10-07 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user in… |
CVE-2026-79815 | Medium | 6.5 | 2026-10-06 | A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. S… |
CVE-2026-79803 | High | 8.8 | 2026-10-06 | A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escala… |
CVE-2026-79802 | High | 8.8 | 2026-10-06 | A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to sup… |
CVE-2026-76754 | Critical | 9.8 | 2026-10-06 | A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against th… |
CVE-2026-105487 | Medium | 6.3 | 2026-10-06 | A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.p… |
CVE-2026-105484 | Critical | 10.0 | 2026-10-06 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/c… |
CVE-2026-105134 | Critical | 10.0 | 2026-10-04 | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Rep… |
CVE-2026-102133 | Medium | 6.6 | 2026-09-30 | An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it… |
CVE-2026-102911 | Critical | 9.9 | 2026-09-30 | A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP to… |
CVE-2026-102906 | Medium | 6.3 | 2026-09-30 | A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child_process.exec… |
CVE-2026-102874 | High | 7.3 | 2026-09-30 | A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execut… |
CVE-2026-102794 | Critical | 9.1 | 2026-09-30 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of… |
CVE-2026-102793 | Critical | 9.1 | 2026-09-30 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This mani… |
CVE-2026-102792 | Critical | 9.1 | 2026-09-29 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the… |
CVE-2026-76727 | High | 7.2 | 2026-09-29 | Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high priv… |
CVE-2026-76724 | Critical | 9.6 | 2026-09-29 | A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform… |
CVE-2026-102827 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-102826 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-102243 | High | 7.4 | 2026-09-29 | A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/tes… |
CVE-2026-102240 | Critical | 10.0 | 2026-09-29 | A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network T… |
CVE-2026-101859 | Medium | 5.4 | 2026-09-29 | A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_… |
CVE-2026-101858 | Medium | 4.7 | 2026-09-29 | A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/W… |
CVE-2026-101264 | Critical | 9.1 | 2026-09-29 | A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the a… |
CVE-2026-101263 | Critical | 9.1 | 2026-09-29 | A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation… |
CVE-2026-101262 | Critical | 9.1 | 2026-09-28 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulatio… |
CVE-2026-101261 | Critical | 9.1 | 2026-09-28 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the a… |
CVE-2026-101260 | Critical | 9.1 | 2026-09-28 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Perform… |
CVE-2026-101187 | Critical | 9.1 | 2026-09-28 | A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/ap… |
CVE-2026-101076 | Critical | 10.0 | 2026-09-28 | A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. Th… |
CVE-2026-101075 | Critical | 10.0 | 2026-09-28 | A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the comp… |
CVE-2026-101072 | Critical | 10.0 | 2026-09-28 | A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such m… |
CVE-2026-101009 | High | 8.4 | 2026-09-28 | A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class… |
CVE-2026-101008 | Critical | 9.1 | 2026-09-28 | A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the componen… |
CVE-2026-101007 | High | 8.4 | 2026-09-28 | A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database… |
CVE-2026-101002 | Critical | 9.9 | 2026-09-28 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component… |
CVE-2026-101001 | Critical | 10.0 | 2026-09-28 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component We… |
CVE-2026-100896 | Critical | 9.9 | 2026-09-28 | A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the comp… |
CVE-2025-51457 | High | 8.8 | 2026-09-25 | D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker wi… |
CVE-2026-97366 | Medium | 6.3 | 2026-09-24 | A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/wind… |
CVE-2026-82370 | | | 2026-09-24 | Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative… |
CVE-2026-95660 | Medium | 6.3 | 2026-09-22 | A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/… |
CVE-2026-65111 | High | 7.8 | 2026-09-22 | NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit o… |
CVE-2026-94139 | High | 7.4 | 2026-09-21 | A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_ord… |
CVE-2026-94138 | Medium | 6.6 | 2026-09-21 | A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /se… |
CVE-2026-94099 | Critical | 9.9 | 2026-09-21 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component… |
CVE-2026-94098 | Critical | 9.1 | 2026-09-21 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component… |
CVE-2026-94097 | Critical | 10.0 | 2026-09-21 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI… |
CVE-2026-94096 | Critical | 9.9 | 2026-09-21 | A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the… |
CVE-2026-94095 | Critical | 9.9 | 2026-09-21 | A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_t… |
CVE-2026-94031 | Medium | 6.3 | 2026-09-20 | A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the… |
CVE-2026-93967 | Medium | 5.5 | 2026-09-20 | A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the… |
CVE-2026-93966 | Medium | 4.7 | 2026-09-20 | A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backen… |
CVE-2026-93965 | Medium | 6.6 | 2026-09-20 | A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO… |
CVE-2026-93958 | Critical | 9.1 | 2026-09-20 | A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipu… |
CVE-2026-93742 | Critical | 9.9 | 2026-09-19 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipula… |
CVE-2026-93533 | Medium | 6.3 | 2026-09-18 | A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of t… |
CVE-2026-88622 | High | 8.8 | 2026-09-18 | NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php. |
CVE-2026-93371 | High | 8.3 | 2026-09-18 | A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/int… |
CVE-2026-85885 | Critical | 9.9 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a… |
CVE-2026-78501 | High | 8.6 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to… |
CVE-2026-55946 | Medium | 6.1 | 2026-09-17 | Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54501 | | | 2026-09-17 | Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1… |
CVE-2026-92993 | Medium | 6.3 | 2026-09-17 | A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/m… |
CVE-2026-20325 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive… |
CVE-2026-20176 | Critical | 9.1 | 2026-09-16 | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected devi… |
CVE-2026-92398 | Critical | 9.1 | 2026-09-16 | A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the… |
CVE-2026-92397 | Critical | 9.1 | 2026-09-16 | A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of… |
CVE-2026-73454 | High | 8.1 | 2026-09-16 | On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended m… |
CVE-2026-76698 | Medium | 6.5 | 2026-09-15 | A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker… |
CVE-2026-76675 | Critical | 9.1 | 2026-09-15 | A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated rem… |
CVE-2026-88765 | High | 8.5 | 2026-09-15 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions cou… |
CVE-2026-91853 | High | 7.4 | 2026-09-15 | A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?acti… |
CVE-2026-90880 | High | 7.4 | 2026-09-15 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of t… |