PT-2026-95491

Name of the Vulnerable Software and Affected Versions btrbk versions 0.29.0 through 0.32.6 Description The ssh filter btrbk.sh script constructs allow stream match using a start anchor but lacks an end-of-string anchor for the complete command. This allows a user restricted by an authorized keys...

CVE-2026-62943: Improper Neutralization of Special Elements used in an OS Command

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

CVE-2026-93605: Protection Mechanism Failure

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

PT-2026-95676

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...

EUVD-2026-82379

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the NodeVM process when an array-shaped require value is supplied with nesting enabled. An...

Improper Privilege Management

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Privilege Management in the require process. An attacker can execute arbitrary commands on the host system by bypassing the intended module...

EUVD-2026-81665

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

CVE-2026-92935: Improper Control of Dynamically-Managed Code Resources

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

PT-2026-94307

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.4 through 3.11.6 Description A sandbox escape exists when the NodeVM constructor incorrectly validates the require configuration. By providing an array-shaped value to the require parameter while nesting is enabled, the...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92718: Improper Verification of Cryptographic Signature

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

PT-2026-93850

Name of the Vulnerable Software and Affected Versions SSH.NET versions prior to 2026.0.0 Description In the ScpClient component, caller-supplied remote paths are placed into the command used to run scp on the server. Because the default RemotePathTransformation.DoubleQuote transformation cannot...

CVE-2026-20324: Missing Authorization

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions t...

CVE-2026-84408: Exposed IOCTL with Insufficient Access Control

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

PT-2026-94044

Name of the Vulnerable Software and Affected Versions Pelican Panel versions prior to 1.0.0-beta35 Description Startup write permissions are enforced only through disabled form controls instead of server-side authorization checks. An attacker with startup.read permission can craft Livewire state...