94908 matches found
CVE-2026-86330
An OS command injection flaw exists in the set_hostname_internal function of NooBaa's cluster_internal_api , a component used for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation . The root cause is the direct passing of the hostname parameter to a shell command without proper...
vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion
A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...
CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...
CVE-2026-78424
Improper parameter handling in NeuVector allows for OS command injection within the privileged enforcer container, potentially leading to a complete compromise of the worker node. This vulnerability affects NeuVector versions 5.4 before 5.4.11 , 5.5 before 5.5.4 , 5.6 before 5.6.2 , and potential...
CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...
EUVD-2026-88224
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...
CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...
CVE-2026-12268
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...
CVE-2026-12267
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...
CVE-2026-12267 Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...
CVE-2026-12267
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection within the Windows DNS Query Resolution Policy name field. This flaw can lead to remote code execution (RCE). No specific exploit details or in-the-wild exploitation information are provided in the documents. Remedia...
EUVD-2026-88215
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...
EUVD-2026-88213
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...
CVE-2026-12268 Authenticated PowerShell Injection leads to RCE
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...
CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...
CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...
CVE-2026-91006
A flaw in Apache Karaf 's instance-management service (InstanceServiceImpl ) allows for arbitrary OS command execution as the Karaf process user. The vulnerability exists because the service builds the launch command for a child Karaf JVM using string concatenation, splicing the caller-supplied j...
CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...