188320 matches found
CVE-2026-46449
The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...
PT-2026-113595
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Samsung Open Source QA-Board allows : OS Command Injection...
...[ More ]
This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...
CVE-2026-110642: Improper Neutralization of Special Elements used in an OS Command
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...
VulnCheck KEV: CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
CVE-2026-46449
The Akamai Guardicore Platform Agent (GPA) for macOS versions prior to 7.4 is vulnerable to a local privilege escalation via a command injection flaw in the wapptunneld component. The root cause is a lack of input validation when the service uses network interface names to execute system utilitie...
PT-2026-113607
Name of the Vulnerable Software and Affected Versions Collabora Online Built-in CODE Server richdocumentscode versions prior to 26.4.303 Description An OS command injection issue exists in the proxy.php endpoint of the richdocumentscode app. The flaw occurs when the built-in CODE server is not...
CVE-2026-106931: Improper Neutralization of Special Elements used in an OS Command
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...
PT-2026-113762
🚨 CVE-2026-0313 A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. 🎖@cveNotify...
PT-2026-114194
🚨 CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24517)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route. This plugin only works with Tenable.ot. Please visit...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20902)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route. This plugin only work...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25105)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route. This plugin only works with Tenable.ot...
Linux Distros Unpatched Vulnerability : CVE-2026-110236
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...
ModelScope MS-Agent 1.5.1 < 1.6.0 Command Injection (CVE-2026-2256)
The version of ModelScope MS-Agent installed on the remote host is 1.5.1 or later but prior to 1.6.0. It is, therefore, affected by a command injection vulnerability. The Shell tool runs commands on the host through a shell, guarded only by a regex denylist that can be bypassed, allowing an...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-21389)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route. This plugin only works with Tenable.ot. Please...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20764)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote...
Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25109)
An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route, leading to remote code execution. This plugi...
PT-2026-113640
Name of the Vulnerable Software and Affected Versions SiteGuard Server Edition versions 2.20 through 8.00 Update4 Description An OS command injection flaw exists in the statistics feature, which is enabled by default. This issue allows an attacker with local access and a low-privileged account to...