Total
3999 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-2129 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manipulation of the argument ac_ipaddr/ac_ipstatus/ap_randtime results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-2120 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configuration Parameter Handler. The manipulation of the argument terminal_addr/server_ip/server_port leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-2118 | 1 Utt | 2 810, 810 Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-2085 | 1 Dlink | 2 Dwr-m921, Dwr-m921 Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-2084 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A weakness has been identified in D-Link DIR-823X 250416. This impacts an unknown function of the file /goform/set_language. Executing a manipulation of the argument langSelection can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-2082 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used. | |||||
| CVE-2026-2081 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-2080 | 1 Utt | 2 810, 810 Firmware | 2026-06-17 | 8.3 HIGH | 7.2 HIGH |
| A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-2063 | 1 Dlink | 2 Dir-823x, Dir-823x Firmware | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web Management Interface. The manipulation of the argument ac_server results in os command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-2061 | 1 Dlink | 2 Dir-823x Firmware, Dir-832x | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was determined in D-Link DIR-823X 250416. Affected by this issue is the function sub_424D20 of the file /goform/set_ipv6. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-2000 | 1 Dcnetworks | 2 Dcme-320, Dcme-320 Firmware | 2026-06-17 | 5.8 MEDIUM | 4.7 MEDIUM |
| A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function apply_config of the file /function/system/basic/bridge_cfg.php of the component Web Management Backend. Performing a manipulation of the argument ip_list results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-27811 | 1 Roxy-wi | 1 Roxy-wi | 2026-06-17 | N/A | 8.8 HIGH |
| Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in `app/modules/config/config.py` on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue. | |||||
| CVE-2026-27001 | 1 Openclaw | 1 Openclaw | 2026-06-17 | N/A | 7.8 HIGH |
| OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions. Starting in version 2026.2.15, the workspace path is sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators. Workspace path resolution also applies the same sanitization as defense-in-depth. | |||||
| CVE-2026-26795 | 1 Gl-inet | 2 Ar300m16, Ar300m16 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2026-26793 | 1 Gl-inet | 2 Ar300m16, Ar300m16 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2026-26792 | 1 Gl-inet | 2 Ar300m16, Ar300m16 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2026-26791 | 1 Gl-inet | 2 Ar300m16, Ar300m16 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input. | |||||
| CVE-2026-26461 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request. | |||||
| CVE-2026-26136 | 1 Microsoft | 1 Copilot | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-26133 | 1 Microsoft | 10 365 Copilot, Edge, Excel and 7 more | 2026-06-17 | N/A | 7.1 HIGH |
| AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. | |||||