PT-2026-94097

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier Description The CloneSite plugin contains a stored OS command injection flaw. The issue occurs in plugin/CloneSite/cloneClient.json.php where a stored SSH password is inserted into a command string using str...

PT-2026-93341

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command...

MiracleLinux 9 : rsync-3.2.7-1.el9_8 (AXSA:2026-1850:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1850:08 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...

CVE-2026-91102: Improper Neutralization of Special Elements used in an OS Command

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

PT-2026-93340

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get iodd menu info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93353

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93351

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93357

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93262

Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...

PT-2026-93855

A vulnerability was found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93347

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save iodd parameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

PT-2026-93981

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description An issue exists involving the improper neutralization of special elements used in a command, which can lead to command injection. This occurs when the software fails to properly...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

Oracle Linux 10 : ELSA-2026-67463-0: / rsync (ELSA-2026-674630)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674630 advisory. - Resolves: RHEL-245337 - Directory escape via TOCTOU CVE-2026-53783 - Resolves: RHEL-244599 - Arbitrary file write CVE-2026-53785 - Resolves:...

rsync security, bug fix, and enhancement update

3.5.0-3 - Related: RHEL-246094 - OPATH for directory travesal full fix 3.5.0-2 - Related: RHEL-246094 - OPATH for directory traversal 3.5.0-1 - Resolves: RHEL-246094 - Rebase rsync to version 3.5.0 in RHEL10 - Resolves: RHEL-245337 - Directory escape via TOCTOU CVE-2026-53783 - Resolves:...

PT-2026-93865

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API of the affected software allows an authenticated remote attacker with administrative credentials to perform command...