https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:51:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352885 EUVD-2026-352885 https://cve.radiocsirt.org/vuln/euvd-2026-352885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71966 <p>CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server&#39;s API response. Attackers can inject malicious commands through a crafted directory name in the remote server&#39;s API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.</p> <p>CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server&#39;s API response. Attackers can inject malicious commands through a crafted directory name in the remote server&#39;s API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71966 https://cve.radiocsirt.org/vuln/ghsa-hmw4-vv3v-9326 <p>CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server&#39;s API response. Attackers can inject malicious commands through a crafted directory name in the remote server&#39;s API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.</p> <p>CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server&#39;s API response. Attackers can inject malicious commands through a crafted directory name in the remote server&#39;s API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.</p> https://cve.radiocsirt.org/vuln/ghsa-hmw4-vv3v-9326 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2743 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen Sicherheitsmaßnahmen zu umgehen, Administratorrechte zu erlangen und beliebigen Code auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen Sicherheitsmaßnahmen zu umgehen, Administratorrechte zu erlangen und beliebigen Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2743