CVE-2026-76583: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/settime.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly...

PT-2026-78464

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fai...

AlmaLinux 10 : pcp (ALSA-2026:55617)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55617 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PMD...

Oracle Linux 8 : pcp (ELSA-2026-55560)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55560 advisory. - Fix CVE-2026-16524: command injection in linuxsockets PMDA RHEL-213662 - Fix CVE-2026-16526: set FDCLOEXEC on AFUNIX sockets RHEL-213686 - Fix missi...

Linux Distros Unpatched Vulnerability : CVE-2026-73073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command...

RockyLinux 8 : sg3_utils (RLSA-2026:56130)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56130 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformance...

SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784...

PT-2026-78433

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for VMs versions 6.0.3 through 6.0.3.1 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A high privileged attacker with remote access could exploit th...

CVE-2026-53542: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-16842: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-78257

Name of the Vulnerable Software and Affected Versions TRENDnet Router version 1.1.02b01 Description A remote command injection flaw exists in the /cgi-bin/ping.cgi endpoint. The issue occurs when the wan type argument is manipulated, allowing an attacker to execute arbitrary commands on the syste...

PT-2026-78358

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A low privileged attacker with remote access can exploit this flaw t...

PT-2026-78604

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to properly...

PT-2026-79998

Improper neutralization of special elements used in a command 'command injection' in Microsoft PowerShell allows an authorized attacker to execute code locally...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

ROS-20260819-73-0011

The vulnerability in MariaDB relates to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260819-73-0007

The vulnerability in MariaDB relates to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-68560: Improper Neutralization of Special Elements used in an OS Command

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

PT-2026-78605

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper neutralization of special elements used in an OS command allows a remote attacker to execute arbitrary commands. Recommendations At the moment, there is no...

CVE-2026-76233: Improper Neutralization of Special Elements used in a Command

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...