94662 matches found
CVE-2026-81548: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
PT-2026-98316
Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...
CVE-2026-95521
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...
CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...
PT-2026-98268
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...
PT-2026-97842
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...
CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...
CVE-2026-93289: Improper Neutralization of Special Elements used in an OS Command
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...
CVE-2026-79766: Improper Neutralization of Special Elements used in an OS Command
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...
CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...
CVE-2026-82370
Brocade SANnav versions before 3.0.1a are vulnerable to an unauthenticated remote command injection in the orchestrator HTTP service. This flaw allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Potential impacts ...
CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...
Exploit for CVE-2026-95675
CVE-2026-95675 - D-Link DAP-1360 !https://threataft.com/im...
CVE-2026-81537
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...
gitpython: GitPython: Command Injection via Git option prefix abbreviation
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...
CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...
CVE-2026-81537
IBM DataStage on Cloud Pak for Data 5.4.0.0 is susceptible to an OS command injection vulnerability. This flaw could allow a remote authenticated attacker to execute arbitrary code on the target system. No specific exploit information or remediation steps are provided in the documents, though the...