Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials...
CVE-2026-66902
Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated sy
#cwe-78
共收录 1628 条相关情报。
← 返回所有主题A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated atta...
CVE-2026-6837
该漏洞被归类为操作系统命令注入，具体存在于 Zyxel WAX650S 无线接入点的 export-cgi CGI 程序中。该程序用于导出配置或日志等操作，在处理相关请求时，未对用户可控的输入进行严格验证和清理，导致当管理员用户发起特定导出
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that...
CVE-2026-67599
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitize...
CVE-2026-67599
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignD...
CVE-2026-18641
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injectio...
CVE-2026-69096
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenti...
CVE-2026-67608
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injecti
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manip...
CVE-2026-18590
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file ad
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument ...
CVE-2026-18587
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account...
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execut
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsa...
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an ...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with cra...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execut
GitPython 3.1.50 Authentication Bypass via Joined Short Options
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
GitPython before 3.1.51 Command Injection via option prefix abbreviation
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This...
CVE-2026-9044
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary co...
CVE-2026-9044
CVE-2026-9044是TP-Link AXE75 V1路由器VPN模块中的一个操作系统命令注入漏洞。该漏洞允许物理相邻且已通过认证的攻击者，通过导入精心构造的VPN客户端配置文件，在设备上以root权限执行任意系统命令。攻击者不需要连