Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1774022191)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774022191 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784298569)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784298569 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a...

CentOS Linux 8 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1771930823)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1771930823 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc (CENTOS7:CLSA-2026:1775222005)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1775222005 advisory. - The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands...

RHEL 9 : pcp (RHSA-2026:72593)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72593 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

CVE-2026-102874: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. T...

CVE-2026-102906: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function childprocess.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

CVE-2026-102133: Improper Neutralization of Special Elements used in a Command

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

CVE-2026-102114: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-103473: Improper Neutralization of Special Elements used in an OS Command

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-100254: Improper Neutralization of Special Elements used in an OS Command

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

CVE-2026-102794: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102793: Improper Neutralization of Special Elements used in a Command

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-103534

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...

PT-2026-103498

Name of the Vulnerable Software and Affected Versions Deno versions 2.7.0 through 2.9.7 Description On Windows, a command injection issue exists in the node:child process module. The escapeShellArg function incorrectly applies POSIX rules instead of Windows cmd.exe rules, which fails to neutraliz...

PT-2026-102999

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely...

PT-2026-103015

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki capture source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has be...

PT-2026-103547

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A command injection flaw allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Command injection is a...

PT-2026-103566

Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description An optional, separately licensed repository-connector feature fails to neutralize special characters in a user-supplied path before passing it to an external command. This allows an...

CentOS Linux 8.4 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS8.4:CLSA-2026:1781081927)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1781081927 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing...