Critical OpenWrt DHCPv6 Flaw CVE-2026-53921 Allows Unauthenticated Remote Code Execution as Root
OpenWrt has released versions 24.10.8 and 25.12.5 to patch a critical DHCPv6 stack overflow vulnerability, CVE-2026-53921, rated 9.8 on CVSS 3.1. The…
Tag: command injection
LuCI: OpenWrt Web Interface
LuCI is the default web-based user interface for OpenWrt. An AI-assisted audit by Hacker House identified multiple vulnerabilities in LuCI components, including…
Critical Arista VeloCloud Orchestrator Command Injection Flaw Exploited in the Wild
A maximum-severity command injection vulnerability in on-premises versions of Arista VeloCloud Orchestrator (VCO) is being actively exploited. Tracked as CVE-2026-16812 with a…
CVE-2025-9528: Linksys E1700 Command Injection Vulnerability
A command-injection flaw in the Linksys E1700 router disclosed in August 2025 with a public exploit. The vendor did not respond to…
Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITYSYSTEM on Microsoft's production image-processing workers, and as root on…
CVE-2016-3714: ImageMagick Delegate Command Injection (ImageTragick)
A critical command injection vulnerability in ImageMagick's delegate mechanism allows remote code execution via crafted image files. This 2016 vulnerability is the…
ImageMagick
An open-source image processing suite used by Bing's pipeline. Its delegate mechanism was exploited to achieve command injection. The article recommends disabling…
Zimbra Patches Critical SNMP Command Injection and Multiple XSS Flaws
Zimbra has released security updates addressing nine vulnerabilities in Zimbra 10.1.20, including a critical command injection flaw in the Simple Network Management…
Open-Source Android AI Agents Vulnerable to Invisible Screen Text Attacks Leading to Host Code Execution
Researchers have demonstrated that open-source Android AI agent frameworks are vulnerable to a novel attack chain where invisible screen text can lead…
WhatsApp-to-Host Attack Chain Exploits Three OpenClaw Flaws for Code Execution
Security researcher Chinmohan Nayak has detailed a WhatsApp-to-host attack chain leveraging three now-patched vulnerabilities in the OpenClaw personal AI assistant. The flaws,…