PT-2026-91081

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91098

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91157

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

PT-2026-91431

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A local attacker can execute arbitrary code due to improper neutralization of special elements used in an...

CVE-2026-90705: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90703: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2026-90702: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-90690: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...

CVE-2026-90617: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function runtask of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible ...

CVE-2026-90894: Improper Neutralization of Argument Delimiters in a Command

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

PT-2026-91137

Name of the Vulnerable Software and Affected Versions Parallels Desktop versions prior to 27.0.0 Description A local privilege escalation issue exists in Parallels Desktop for Mac where an unprivileged local user can execute code as root. The prl disp service daemon runs with root privileges and...

CVE-2026-16673: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property...

CVE-2026-57124: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-82791: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91428

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary OS commands. This occurs due to improper neutralization of special characters within the PxPeek name property. Recommendation...

Checkov Special Elements Command Injection

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows attackers to execute arbitrary commands...

PT-2026-91108

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional...

CVE-2026-90704: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

PT-2026-91240

Name of the Vulnerable Software and Affected Versions magicblack MacCMS10 version 2026.1000.4055 Description A flaw in the Template Handler component allows remote attackers to perform OS command injection. This occurs through the manipulation of the file...

CVE-2026-90788: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...