PT-2026-102811

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced...

Amazon Linux 2 : gdb (ALAS-2026-3958)

The version of gdb installed on the remote host is prior to 8.0.1-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3958 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...

Amazon Linux 2023 : gdb, gdb-gdbserver, gdb-headless (ALAS2023-2026-3142)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3142 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal bug in the code that separates destructor and non- destructormember...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-75600

FreePBX, an open-source IP PBX, is vulnerable to Host Command Injection in versions prior to 17.0.9 . The vulnerability exists in the GraphQL api module's documentation generator , which accepts an authenticated host parameter and incorporates it into a shell command without proper validation or ...

EUVD-2026-88391

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-75600 FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

EUVD-2026-88386

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

CVE-2024-29269-EXPLOIT

CVE-2024-29269 - Telesquare TLR-2005KSH リモートコード実行 RCE Telesquare TLR-2005Ksh バージョン1.0.0および1.1.4において、攻撃者が Cmd パラメータを悪用して任意のシステムコマンドを実行できる可能性がある問題が特定されました。この脆弱性により、権限のない個人が影響を受けるシステム上でコマンドを実行し、不正アクセスやその他の悪意のある活動につながる可能性があります。 概念実証 PoC エクスプロイト 教育目的のみとして、脆弱性を実証するための概念実証 PoC...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

CVE-2026-86330

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

EUVD-2026-88236

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...