CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer

Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...

Multiple vulnerabilities in Lite-On O-RU "FF-RFI079I4" and "FF-RFI078I4"

Overview O-RU "FF-RFI079I4" and "FF-RFI078I4" provided by LITE-ON Technology Corporation contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-77853 Hidden Functionality CWE-912 - CVE-2026-80217 Yuto Aono, Yutaro Osako, and Shunsuke Saruwatari of The University of...

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of...

PT-2026-92451

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description Buffer overflow vulnerabilities exist in the API endpoint of the system. A buffer overflow occurs when a program writes more data to a block of memory, or...

PT-2026-92120

Name of the Vulnerable Software and Affected Versions Yonyou U8 CRM affected versions not specified Description An unauthenticated SQL injection exists in the 'fillbacksettingedit.php' endpoint. By using the DontCheckLogin=1 parameter, authentication is bypassed, and the id parameter is...

CVE-2026-76705: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76691: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76683: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation...

CVE-2026-61667: Improper Neutralization of Special Elements used in an SQL Command

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-53710: Improper Control of Generation of Code

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the pythonsandboxserver in mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py exposes raw getattr through safebuiltins, omits a required getattr guard, and relie...

CVE-2026-12101: Authentication Bypass by Alternate Name

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

CVE-2026-63443: Incorrect Authorization

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-55158: Improper Neutralization of Special Elements used in an OS Command

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...

CVE-2026-47424: Protection Mechanism Failure

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-57133: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

PT-2026-92447

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...

PT-2026-92056

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag version and node...

CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...