CVE-2026-107779: Missing Authentication for Critical Function

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...

PT-2026-108043

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description A filter bypass exists in the bundled MathJax 3.2.2 Safe component. An attacker can execute arbitrary code by embedding a crafted href value containing a TAB byte in the URL scheme. This...

PT-2026-107811

Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...

PT-2026-107839

Name of the Vulnerable Software and Affected Versions SecuShare Pro version 4 Description SecuShare Pro contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. OS Command Injection is a flaw where ...

CVE-2026-87677: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associat...

CVE-2026-94579: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

CVE-2026-94581: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

CVE-2026-87673: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...

CVE-2026-107699: Improper Neutralization of Special Elements used in an OS Command

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

CVE-2026-87663: Authentication Bypass by Spoofing

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these...

PT-2026-108295

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.5.3 Description An issue exists where an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting. This command li...

PT-2026-108229

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of command arguments. Th...

PT-2026-108142

Name of the Vulnerable Software and Affected Versions Amazon Agent Plugins for AWS databases-on-aws versions prior to 1.7.1 Description An incomplete list of disallowed inputs allows a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper. This...

PT-2026-108115

Name of the Vulnerable Software and Affected Versions OpenStack Mistral versions prior to 23.0.0 Description The std.ssh proxied action passes a caller-supplied proxy command value directly to the paramiko.ProxyCommand function before attempting an SSH connection to a gateway or target host. An...

PT-2026-108042

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description Insufficient sanitization of the data-background-iframe attribute allows the bypass of DOMPurify. This issue is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin,...

PT-2026-107820

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An authenticated user with permissions to perform configuration downloads using remote server profiles can execute arbitrary shell comman...

PT-2026-107812

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An authentication bypass and command injection issue exists in the inter-switch remote execution service. When processing remote command...

PT-2026-107818

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection flaw exists in the REST API management interface. An authenticated remote attacker with high privileges can execu...

PT-2026-108307

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description In the src/SelectionTranslate.cpp file, selected or pasted translation text is embedded in quoted Windows command lines using incomplete quote-only escaping. This issue affects the...

PT-2026-108189

Name of the Vulnerable Software and Affected Versions Tenable Identity Exposure SaaS affected versions not specified Description A command injection flaw exists in the Active Directory Events Listener. This allows an authenticated attacker with low privileges to execute arbitrary commands with...