CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway

An input validation issue in the Okta Access Gateway OAG Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account...

CVE-2026-115547

The Okta Access Gateway (OAG) Admin Console is vulnerable to Command Execution due to an input validation issue that allows the processing of specially formatted configuration values. An authenticated administrator can exploit this vulnerability to execute arbitrary system commands within the con...

CVE-2026-66492

Path Traversal in File Upload Destination PhocaCommander ≤ 6.1.3 — Authenticated Admin Writes Files Outside Webroot SUMMARY The file upload handler in PhocaCommander constructs the destination path from an attacker-controlled base64-encoded folder parameter without any path containment validation...

CVE-2026-12660

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-12660 IBM MQ Path Traversal

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

EUVD-2026-104466

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-12660

The IBM MQ Web Console is vulnerable to a path traversal issue (CWE-22) caused by improper path validation . This flaw could allow an authenticated administrator to write files outside the intended directory. The CVSS 3.1 base score is 2.7 (Low) , with an integrity impact of low and no impact on ...

CVE-2026-0313

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

EUVD-2026-101674

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

Cortex XSOAR: OS Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. Work around: Customers who are unable to upgrade immediately can mitigate this issue by disablin...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

PT-2026-113762

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XSOAR affected versions not specified Palo Alto Networks Cortex XSIAM OS Query content pack affected versions not specified Description A command injection issue in the OS Query content pack allows an authenticated...

BIT-GHOST-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

PT-2026-110487

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description A path traversal issue in the SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This can...

EUVD-2026-95789

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-79363

Cloudron versions 9.1.7 and 9.2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Branding Footer feature. An authenticated administrator can exploit this by storing crafted HTML containing JavaScript event handlers in the Footer setting. Because the application fail...

CVE-2026-87679

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

PT-2026-107724

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 10.0.1 Description An issue exists when processing trunk configuration operations where the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary...

Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...