ruby security, bug fix, and enhancement update

3.0.7-168 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252044 3.0.7-167 - Fix information disclosure via MITM attack bypassing TLS in net-imap. CVE-2026-42246 Resolves: RHEL-181763 - Fix command injection via Symbol arguments in net-imap...

EUVD-2026-89361

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-79535: Improper Neutralization of Special Elements used in an OS Command

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-101858: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-102937: Improper Neutralization of Special Elements used in an OS Command

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

PT-2026-102420

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the SSID Processing component. The issue occurs within the WiFiManager::writeWpaSupplicant function located in the...

PT-2026-102672

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

PT-2026-102959

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the url argument within the '/api/ZRnetwork/ping' endpoint. This allows an attacker to execute arbitrary commands on the system...

PT-2026-102427

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the OpenVPN Configuration Handler component. The issue occurs within the escapeshellcmd function located in the ajax/openvpn/del ovpncfg.php file. ...

PT-2026-102818

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The update config MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

RHEL 9 : pcp (RHSA-2026:72594)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72594 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

PT-2026-102934

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A flaw in the set time zone function within the '/api/ZRFirmware/set time zone' endpoint allows for remote command injection. This occurs through the manipulation of the hostname/zonename argument...

CVE-2026-102792: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

PT-2026-102435

Name of the Vulnerable Software and Affected Versions Netcore NAP930 version 0.1.241010.141410 Description Remote OS command injection is possible within the Network Tools CGI component. The issue exists in the eval function of the '/www/cgi-bin/network tools' endpoint, where improper handling of...

CVE-2026-101859: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

PT-2026-102520

Name of the Vulnerable Software and Affected Versions DeepSeek-Reasonix Studio versions prior to 2.21.0 DeepSeek Reasonix npm versions prior to 1.39.3 Description An OS command injection flaw exists in the internal/gitcmd component of DeepSeek-Reasonix Reasonix Studio. A local attacker who contro...

CVE-2026-102437: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-101261

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetupwifi. Executing a manipulation of the argument loginpwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. Th...

CVE-2026-101262

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2026-101260

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...