CVE-2026-0634 is a high-severity vulnerability in the AssistFeedbackService component of TECNO Mobile's TECNO Pova7 Pro 5G running HiOS V15.1.0. It allows local applications with limited privileges to execute arbitrary code with system-level permissions via command injection due to improper neutralization of argument delimiters. This vulnerability can lead to full compromise of confidentiality, integrity, and availability on affected devices. No public exploits are known at this time, and no patch or remediation information is currently available.
The golang packages provide the Go programming language compiler.
Security Fix(es):
* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.
CVE-2026-1717 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying products caused by improper neutralization of argument delimiters (CWE-88) in the LenovoProductivitySystemAddin. This flaw allows a local authenticated user to perform argument injection, enabling them to terminate arbitrary processes with elevated privileges without user interaction. The vulnerability requires local access and low attack complexity but does not require additional authentication beyond local user privileges. There are no known exploits in the wild currently, and no patches have been published yet. The CVSS 4.0 score is 6.8, reflecting the moderate risk due to privilege escalation potential. Organizations using Lenovo Vantage on Windows systems should monitor for updates and restrict local user permissions to mitigate risk. Countries with significant Lenovo market penetration and enterprise usage are most at risk, including the United States, China, Germany, Japan, and India. This vulnerability highlights the importance of secure input validation in privileged system components to prevent local privilege escalation attacks.
CVE-2026-1716 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying's DeviceSettingsSystemAddin component. It involves improper neutralization of argument delimiters (CWE-88), allowing a local authenticated user to perform argument injection. Exploiting this flaw enables deletion of arbitrary registry keys with elevated privileges, potentially impacting system integrity and stability. The vulnerability requires local authentication but no user interaction and has no known exploits in the wild. It affects Lenovo Vantage installations globally, especially where Lenovo devices are widely used. Mitigations include applying vendor patches once available, restricting local user privileges, and monitoring registry changes. The threat is significant for organizations relying on Lenovo hardware management tools, particularly in enterprise environments. The CVSS 4.0 base score is 6.9, reflecting medium severity due to the local attack vector and high impact on integrity and availability.
CVE-2026-1715 is a medium severity vulnerability in Lenovo Vantage and Lenovo Baiying's DeviceSettingsSystemAddin component. It involves improper neutralization of argument delimiters (CWE-88), allowing a local authenticated user to perform argument injection. This flaw enables modification of arbitrary registry keys with elevated privileges without requiring user interaction. The vulnerability has a CVSS 4.0 score of 6.9, indicating moderate risk primarily due to its local attack vector and requirement for authenticated access. No known exploits are currently reported in the wild, and no patches have been linked yet. Organizations using Lenovo Vantage on Windows systems should be aware of this risk as it could lead to privilege escalation and system configuration compromise. Mitigation involves restricting local user access, monitoring registry changes, and applying vendor updates once available. Countries with significant Lenovo hardware deployment and enterprise usage are most at risk.
A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the specific CGI executable in use, the impact is either source code disclosure or remote code execution (RCE). Anyone hosting CGI scripts (particularly interpreted languages like PHP) using vulnerable versions of TinyWeb is impacted. The problem has been patched in version 2.01. If upgrading is not immediately possible, ensure `STRICT_CGI_PARAMS` is enabled (it is defined by default in `define.inc`) and/or do not use CGI executables that natively accept dangerous command-line flags (such as `php-cgi.exe`). If hosting PHP, consider placing the server behind a Web Application Firewall (WAF) that explicitly blocks URL query string parameters that begin with a hyphen (`-`) or contain encoded double quotes (`%22`).
bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`.
This issue affects Foomuuri: from ? before 0.31.
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper
In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.
CVE-2025-62847 is a medium severity vulnerability in QNAP Systems Inc. QTS operating system versions 5.2.x. It involves improper neutralization of argument delimiters in a command, which allows remote attackers to alter execution logic without requiring privileges or user interaction. The vulnerability has been fixed in QTS 5.2.7.3297 build 20251024 and later, as well as in QuTS hero versions h5.2.
Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.
