EUVD-2026-91795

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

VORNEX-MTOOL

⚡ VORNEX-MTOOL – Gelişmiş Güvenlik Denetim & Sızdırma Testi Ar...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

MovableType - Remote Command Injection

MovableType 5002 and earlier Movable Type Advanced 7 Series, Movable Type Advanced 6.8. 2 and earlier Movable Type Advanced 6 Series, Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified...

EUVD-2026-91064

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63...

PT-2026-104410

Name of the Vulnerable Software and Affected Versions Nx versions 21.4.0 through 22.7.7 Nx versions 23.0.0 through 23.1.0 Description The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values...

PT-2026-104453

Name of the Vulnerable Software and Affected Versions PeaZip versions prior to 11.3.0 Description In a non-default configuration, the software is susceptible to OS command injection. This occurs when a filename within an archive is processed and the application mishandles cases where a quotation...

CVE-2026-104859: Improper Neutralization of Special Elements used in an OS Command

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (crlsa-2026_74095)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674095 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: Arbitrary file deletion via malicious file lis...

PT-2026-104430

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Distribution versions prior to 2.14.12 Amazon SageMaker Distribution versions prior to 3.9.12 Amazon SageMaker Distribution versions prior to 4.0.11 Amazon SageMaker Distribution versions prior to 4.1.11 Amazon SageMaker...

CVE-2026-104019: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

CVE-2026-75937: Improper Neutralization of Special Elements used in an OS Command

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-105050: Incorrect Behavior Order: Validate Before Canonicalize

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...

PT-2026-104442

Name of the Vulnerable Software and Affected Versions Digi DAL OS affected versions not specified Description An OS Command Injection flaw exists in the web administration interface. An unauthenticated attacker can send a specially crafted HTTP POST request to execute arbitrary operating system...

MiracleLinux 8 : rsync-3.1.3-28.el8_10 (AXSA:2026-1954:09)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1954:09 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: Arbitrary file deletion via malicious fi...

Important: Red Hat Security Advisory: pcp security update

An update for pcp is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...