CVE-2026-38710

The TR1200 v2.4.15 and TR3000 v2.4.21 devices are vulnerable to a command injection vulnerability within the system.setclock interface. An attacker can exploit this flaw by providing a crafted input to execute arbitrary commands with root privileges . No patch is currently available; however, it ...

GitPython Command Injection

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

RockyLinux 8 : vim (RLSA-2026:48703)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48703 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrin...

CVE-2026-12943

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-12943

CVE-2026-12943 affects IBM Power HMC and PowerVM Novalink components. IBM HMC v10.3.1050.0–10.3.1064.0 and v11.1.1110.0–11.1.1112.0 allow an unauthenticated user to execute arbitrary commands with elevated privileges due to improper validation of user input. CAMs indicate a CVSS v3.1 base score o...

CVE-2026-12943 This Power Hardware Management Console update is being released to address

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-12943

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-12943 This Power Hardware Management Console update is being released to address

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

SUSE CVE-2026-34448

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...

SUSE CVE-2026-42589

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded i...

SUSE CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options...

SUSE CVE-2026-45626

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/id/volumes/volumeName/browse accepts a path query parameter that is passed to a shell command sh -c "find ... | while ..." inside an Arcane helper container. The path...

CVE-2026-14522

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

Summary OliveTin's checkShellArgumentSafety function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include regex:-prefixed types. Because regex: support was added independently via typeSafetyCheckRegex, any Shell mode action using a regex:-typed argument...

CVE-2026-14522

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

EUVD-2026-51137

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-14522

CVE-2026-14522 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue stems from improper neutralization of CRLF characters, enabling a remote attacker to execute arbitrary commands. Impact is high: remote code execution with CPU/network access and no use...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-44096 udhcpc Privilege Escalation

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise...