57777 matches found
CVE-2026-84502: Improper Neutralization of Argument Delimiters in a Command
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...
CVE-2026-84714: Incomplete List of Disallowed Inputs
A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...
CVE-2026-79310: Improper Control of Generation of Code
webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...
PT-2026-97205
Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...
CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...
PT-2026-97357
Name of the Vulnerable Software and Affected Versions web.py version 0.76 Description Server-side template injection SSTI occurs when the template engine is tricked into executing attacker-controlled template code, bypassing built-in security checks. This happens when an application precompiles...
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...
Linux Distros Unpatched Vulnerability : CVE-2026-93012
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...
PT-2026-97551
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...
CVE-2026-50227: Missing Authentication for Critical Function
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...
PT-2026-97240
Name of the Vulnerable Software and Affected Versions CGServiSign affected versions not specified Description An OS Command Injection flaw exists in CGServiSign. Unauthenticated remote attackers can trick victims into visiting a malicious web page to inject arbitrary operating system commands...
PT-2026-97595
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...
PT-2026-97264
Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...
PT-2026-97543
Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description An input-validation flaw exists in the sanitize jinja function. The function employs two regular expressions to reject user-supplied Jinja, but these patterns stop at the first...
PT-2026-97668
Name of the Vulnerable Software and Affected Versions Drupal Cloud versions 0.0.0 through 7.0.1 Description An OS Command Injection issue exists in the Cloud module, which allows users to manage cloud resources. The module fails to sufficiently sanitize the Git branch and repository URL values...
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...
CVE-2026-16469
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...