57802 matches found
CVE-2026-17417 IBM i is Affected By Remote Code Execution Vulnerabilities [, ]
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
CVE-2026-17417
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...
EUVD-2026-57414
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...
CVE-2026-63300 Cross-project instance move bypasses all project restrictions allowing host command execution
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
CVE-2026-63300
CVE-2026-63300 : The vulnerability is in LXD’s instancePostMigration function (lxd/instance_post.go). An authenticated attacker with can_create_instances in a restricted project can bypass project-level restrictions during cross-project instance migration because the target project’s enforced res...
CVE-2026-63300 Cross-project instance move bypasses all project restrictions allowing host command execution
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
CVE-2026-63300 Cross-project instance move bypasses all project restrictions allowing host command execution
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...
EUVD-2026-57431
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...
CVE-2026-73330
CVE-2026-73330 affects CamaleonCMS 2.9.1 and stems from a server‑side template injection in the test_email action. An authenticated administrator can submit an email parameter containing ERB expressions; when an SMTP rejection is reflected back in the exception message rendered as an inline ERB t...
CVE-2026-73330 CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...
CVE-2026-18235
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...
CVE-2026-17110
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...
CVE-2026-16904
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...
EUVD-2026-57380
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16956
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-16956 due to improper neutralization of special elements used in an OS command, enabling remote command execution. The vulnerability impacts IBM Db2 Mirror for i running these versions and is rated CVSS v3.1 base score 9.8 (...
CVE-2026-16956 IBM Db2 Mirror for i is vulnerable to OS command injection []
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-17110
IBM i 7.6, 7.5, 7.4, and 7.3 are affected by CVE-2026-17110, allowing a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management. Affected IBM i release levels are 7.6/7.5/7.4/7.3 with 5770-SS1; remediation via PTFs SJ10867/...