PT-2026-102799

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists in the CLI certificate SMIME recipient deletion functionality that allows an authenticated privileged CLI user to perform command injection. This can lead to the execution o...

CVE-2026-102243: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102240: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/networktools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has be...

CVE-2026-101859: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101858: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101264: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/setpasswd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-84440: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter service, which runs...

CVE-2026-84436: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-84422: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges...

CVE-2026-76727: Improper Neutralization of Special Elements used in a Command

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-79535: Improper Neutralization of Special Elements used in an OS Command

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

PT-2026-102800

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Command injection exists in the certificate export CLI functionality. A privileged authenticated CLI user can exploit this weakness to execute arbitrary commands with root privileges...

PT-2026-102931

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set syslog of the file /api/ZRnetwork/set syslog. The manipulation of the argument conloglevel/log size results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-76724: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

PT-2026-102871

🚨 CVE-2026-76727 Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-102792: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

PT-2026-102437

Name of the Vulnerable Software and Affected Versions MODSetter SurfSense versions prior to 2.0.4 Description An issue in the MCP Connector Integration component allows for remote command injection. This occurs due to improper processing of the /api/search-source/connectors/mcp/test endpoint...

PT-2026-102959

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the url argument within the '/api/ZRnetwork/ping' endpoint. This allows an attacker to execute arbitrary commands on the system...