FortiMail argument injection lets privileged admins run root commands
Domain or system admins can also delete users on a paired FortiAuthenticator and read or write files as root.
Stories per day · 30 days
2 RSS
Relatedfortinet2file-write1fortianalyzer1fortiauthenticator1fortimail1fortimanager1hue-bridge1philips1remote-code-execution1zdi1
10 stories, newest first · one card per story
Stories tagged #argument-injection
FortiManager argument injection lets privileged admins run commands
The CWE-88 issue is scored 7.2 and also covers both Cloud products; exploitation is not stated.
Philips Hue Bridge Pro argument injection allows restricted file writes
ZDI rates CVE-2026-118631 at CVSS 3.8 and requires low-privileged code inside a container first.
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
Attackers chained two MikroTik RouterOS SSH flaws to seize internet-exposed routers without authentication; CISA lists one in KEV.
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.
6
Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access
JFrog's 'ParaShells' research details CVE-2026-90894, a Parallels Desktop local privilege escalation letting unprivileged macOS users gain root via tar argument injection.
3
Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root
JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.
3
Cisco Integrated Management Controller Argument Injection Vulnerabilities
Cisco patched multiple argument-injection vulnerabilities in Cisco IMC's web management interface allowing authenticated attackers root command execution.
[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090
Vim sign_jump() before v9.2.1090 permits Ex command injection via unescaped buffer names; low-severity patch disclosed by Christian Brabandt.
[remote] mcp-server-kubernetes 3.8.x - Argument Injection
Argument injection in mcp-server-kubernetes 3.8.x MCP server could allow AI clients to execute unintended Kubernetes operations.