Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18,496 results · page 3 of 370
Oct 21, 2026Ajax Search Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111852 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
- Product
- Ajax Search Lite
- Affected
- up to 4.14.6
- What to do
- Affects up to 4.14.6. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminateCVE-2026-58064 · Websites & servers · Apache Software Foundation · reported by security@apache.org
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service. Root Cause: The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation. Affected Scenarios: Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients. How to Fix: 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3363 . Note: The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.
- Product
- Apache bRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header.CVE-2026-56388 · Websites & servers · Apache Software Foundation · reported by security@apache.org
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process. Root Cause: RedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zero elements and continued parsing. When a following bulk string was parsed, the only index guard was a CHECK. In configurations where fatal logs do not abort immediately, execution could continue and write to _args[0] even though the vector was empty. Affected Scenarios: Deployments that enable ServerOptions.redis_service and accept Redis protocol traffic from untrusted clients. The issue is reached during parsing before command handling or authentication. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3354 Note: The fix rejects empty RESP arrays as invalid Redis commands and replaces the internal index CHECK with an explicit parse error so malform
- Product
- Apache bRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on AndroiCVE-2026-70386 · Other software · OnePlus · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.5
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
- Product
- OxygenOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root byCVE-2026-114107 · Other software · HKUDS · reported by VulnCheckHigh 8.7
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
- Product
- Vibe-Trading
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (HostCVE-2026-105044 · Other software · Qingteng · reported by mandiant-cve@google.comHigh 8.5
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection
- Product
- Host Adaptive Security Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).CVE-2026-9814 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.CVE-2026-40627 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327.CVE-2026-35499 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).CVE-2026-33568 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).CVE-2026-10138 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).CVE-2026-10135 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).CVE-2026-10131 · Other software · totolink · reported by talos-cna@cisco.comCritical 9.1
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Totolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding CVE-2026-107929 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9
When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result ofCVE-2026-86410 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9
A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes CVE-2026-113802 · Other software · Wavlink · reported by VulnCheckCritical 9.3
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
- Product
- WL-WN530BE1-A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as tCVE-2026-86471 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.3
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 20, 2026Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delCVE-2026-113677 · Other software · froxlor · reported by VulnCheckMedium 5.3
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record viCVE-2026-113676 · Other software · froxlor · reported by VulnCheckMedium 5.3
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.CVE-2026-108087 · Websites & servers · Apache Software Foundation · reported by security@apache.org
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Cocoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 20, 2026A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.CVE-2026-43850 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.6
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comcsa.gov.sg
Oct 20, 2026A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.CVE-2026-43836 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.3
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comcsa.gov.sg
Oct 20, 2026ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability.CVE-2026-113403 · Computers, phones & browsers · ArmorX Global Technology · reported by twcert@cert.org.twHigh 7.1
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
- Product
- ArmorX Spam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 20, 2026Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.CVE-2026-113386 · Email & office · reported by MITREHigh 7.1
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Oct 19, 2026Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing CVE-2026-75753 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.3
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsCVE-2026-77934 · Other software · coze-dev · reported by VulnCheckHigh 8.7
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
- Product
- coze-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agentCVE-2026-77930 · Other software · EvoScientist · reported by VulnCheckCritical 9.3
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.
- Product
- EvoScientist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI commonCVE-2026-77926 · Other software · apconw · reported by VulnCheckHigh 8.7
Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands through the ChatBI common agent's ungated deepagents execute tool. Attackers can send crafted chat input to POST /dify/get_answer or upload documents with malicious text to run host commands, exposing datasource credentials and model API keys.
- Product
- Aix-DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlasso.security
Oct 19, 2026OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because tCVE-2026-109444 · Other software · Tracer-Cloud · reported by VulnCheckCritical 9.3
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
- Product
- opensre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execCVE-2026-109443 · Other software · jd-opensource · reported by VulnCheckHigh 8.7
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.
- Product
- JoySafeter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting inCVE-2026-109440 · Other software · ginlix-ai · reported by VulnCheckHigh 8.7
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
- Product
- LangAlpha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlasso.security
Oct 19, 2026The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->CVE-2026-77684 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 5.7
The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and cleared hf->acl, and no other code path ever dequeues those buffers, so each one is permanently lost from the fixed hf_pool (CONFIG_BT_MAX_CONN + 1 buffers, i.e. two in the default configuration). The same function also left BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() wiped the object with memset() as soon as hf->acl was NULL, without checking whether hf->work, hf->slc_work or hf->deferred_work was still pending or running. The remote Audio Gateway peer controls the trigger end to end and needs no application involvement: an unsolicited +BCS: 1 response makes bcs_handle() call bt_hfp_hf_select_codec() and queue an AT+BCS buffer, which cannot be transmitted while BT_HFP_HF_FLAG_RX_ONGOING is set, and an immediately following RFCOMM DISC strands that buffer. Repeating the connect / +BCS / disconnect cycle a couple of times empties hf_pool for good. With the pool exhausted, HFP command sending fails permanently, and because
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service.CVE-2026-103038 · Other software · StreamSoft · reported by help@fluidattacks.comHigh 8.6
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
- Product
- PingTools Network Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.complay.google.com
Oct 19, 2026Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped singCVE-2026-112263 · Other software · alexpasmantier · reported by VulnCheckHigh 8.5
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
- Product
- television
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin.CVE-2026-108776 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9k_wmi_rsp_callback() removes the validCVE-2026-98828 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9k_wmi_rsp_callback() removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that expectation can therefore be read beyond the skb payload. Record -EMSGSIZE for a short response, complete the waiter, and return the stored status from the command path. This also prevents callers from consuming stale response bytes as a successful reply.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-freeCVE-2026-98814 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed: BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core] Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->CVE-2026-98737 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_create_conn_sync() and hci_stop_discovery_sync() look up entries and read their fields without taking hdev->lock. After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire hdev->lock and flush the cache, freeing the entry. The worker then reads the freed entry while preparing a create-connection or remote-name-cancel command. The list traversal also races with cache updates and removal. KASAN reported these accesses: BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5f1/0x650 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_acl_create_conn_sync+0x5f1/0x650 hci_cmd_sync_work+0x13c/0x290 Allocated by task 90: hci_inquiry_cache_update+0x3e6/0x7d0 hci_inquiry_result_evt+0x3cb/0x560 Freed by task 93: hci_inquiry_cache_flush+0x111/0x2b0 hci_inquiry+0x2f2/0x780 hci_sock_ioctl+0x269/0x5f0 BUG: KASAN: slab-use-after-free in hci_stop_discovery_sync+0x3b1/0x3c0 Workqueue: hci0 hci_cmd_sync_work
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive patCVE-2026-98583 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach the data access before the malformed packet is rejected. Validate the complete helper command length before stripping the NCI data header.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cdaCVE-2026-98478 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-110895 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
- Product
- Support Genix
- Affected
- up to 1.4.54
- What to do
- Affects up to 1.4.54. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109894 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
- Product
- Booktics
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.CVE-2026-108743 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 16, 2026Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.CVE-2026-81452 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.
- Product
- Alienware Command Center (AWCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to CVE-2026-111638 · Other software · moul · reported by VulnCheckHigh 8.3
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
- Product
- sshportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them.CVE-2026-77474 · Other software · Dicklesworthstone · reported by GitHubHigh 7.1
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.
- Product
- destructive_command_guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBusCVE-2026-96425 · Other software · UBports · reported by cve@gitlab.comMedium 5.5
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
- Product
- lomiri-download-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ubports.comgitlab.com
Oct 16, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache KylinCVE-2026-64959 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 16, 2026MapSVG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111399 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.
- Product
- MapSVG
- Affected
- up to 8.16.1
- What to do
- Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Green Popups: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94388 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
- Product
- Green Popups
- Fixed in
- 7.6.3
- What to do
- Update Green Popups to 7.6.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.