CVE-2026-79800: Improper Limitation of a Pathname to a Restricted Directory

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

PT-2026-107199

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An authenticated path traversal vulnerability exists in the command line interface. This flaw allows a low-privileged authenticated remote attacker to execute arbitrary code...

OS Command Injection via Fabric Synchronization

: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys...

Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)

: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

Command Injection via Unsanitized Remote Brocade Fabric OS Configuration Import Utility

: An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...

Authenticated Privilege Escalation via Command Injection in Timezone Configuration Processing

: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

Authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS

: An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these...

Privilege escalation vulnerability exists in the internal Command-Line Interface of Fabric OS (CVE-2026-94577)

: A privilege escalation vulnerability exists in the internal Command-Line Interface CLI authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypas...

Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows

: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

Local Privilege Escalation via Command Injection in Brocade Fabric OS Diagnostic Utility

: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...

Command Injection vulnerability exists in Brocade Fabric OS REST API management interface

: A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

Command Injection in Security Certificate Management Subsystem

: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution...

PT-2026-106347

Name of the Vulnerable Software and Affected Versions Android Camera driver affected versions not specified Description Memory corruption occurs when the Android Camera driver processes command buffer requests that contain invalid length parameters. Recommendations At the moment, there is no...

PT-2026-106750

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...

PT-2026-107213

A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint...

PT-2026-107146

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

PT-2026-106747

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

PT-2026-106355

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DOS occurs when processing a continuous receive command that includes a zero-sized global configuration override. Recommendations A...

PT-2026-106738

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...

PT-2026-106708

Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...