CVE-2026-88888: Improper Neutralization of Special Elements used in an OS Command

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

PT-2026-89633

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary code. This occurs due to improper neutralization of special elements used in an OS command, which allow...

CVE-2026-81048: Improper Neutralization of Special Elements used in a Command

Dell ThinOS 10, versions prior to 260510.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89399

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

CVE-2026-73694: Improper Neutralization of Special Elements used in an OS Command

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

CVE-2026-88272: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

PT-2026-89313

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

CVE-2026-82095: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89396

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7 Description A command injection issue exists in the gomod manager when processing unescaped depName parameters during import-path update commands while operating in binarySource=docker mode. This occurs durin...

PT-2026-89397

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

PT-2026-89418

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

...[ More ]

This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...

PT-2026-89463

Dell ThinOS 10, versions prior to 2605 10.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89468

Dell ThinOS 10, versions prior to 2605 10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-89467

Name of the Vulnerable Software and Affected Versions Dell ThinOS 10 versions prior to 2605 10 Description An improper neutralization of special elements used in an OS command leads to an OS Command Injection. This allows an unauthenticated attacker with remote access to execute arbitrary command...

PT-2026-89486

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description A remote, authenticated user with the accessCp permission can execute operating system commands with the privileges of the PHP web worker via the Control Panel. Recommendations At the momen...

PT-2026-89639

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary code. This occurs due to improper neutralization of special elements used in an OS command, which allow...

PT-2026-89642

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89614

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Remote authenticated attackers can execute arbitrary commands due to improper validation of command-line arguments within the MCP stdio server configuration. Recommendations Update IBM...

PT-2026-89595

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...