Linux Distros Unpatched Vulnerability : CVE-2026-68518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values...

Oracle Linux 10 : pcp (ELSA-2026-55617)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55617 advisory. - Fix CVE-2026-16530: pmLogLoadInDom OOB pointer dereference RHEL-213746 - Fix CVE-2026-16531: pmproxy logger servlet path traversal RHEL-213756 - Fi...

PT-2026-80420

FTP command injection via custom encoding in github.com/rclone/rclone...

CVE-2026-24301: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

Microsoft Windows Admin Center Remote Code Execution

Microsoft Windows Admin Center builds prior to 2.7.4 contain a command injection vulnerability in the PowerShell tool REST API. An authenticated low-privileged gateway user can supply arbitrary commands through the properties.script field of an invokeCommand request, resulting in command executio...

RHEL 9 : pcp (RHSA-2026:55740)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55740 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RockyLinux 9 : pcp (RLSA-2026:55740)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55740 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PMD...

TencentOS Server 3: vim (TSSA-2026:0857)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0857 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-53533: Improper Neutralization of Special Elements used in a Command

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

PT-2026-83383

Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...

CVE-2026-53455: Improper Neutralization of Special Elements used in an OS Command

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

PT-2026-80415

PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...

ROS-20260818-73-0025

The vulnerability in MariaDB relates to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

pcp security update

7.0.3-5.0.1 - Fix unterminated backtick in pmloggerjanitor fix not to terminate unauthorized process patch Orabug: 39270658 - Adds interval option support in PCP nfsiostat tool Orabug: 39068870 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 39096683 - adds numastat process option in...

CVE-2026-75094: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

ROS-20260818-73-0026

The vulnerability in Mariadb 10.6 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260818-73-0028

The vulnerability in Mariadb 11.8 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Wavestore VMS 6.48.809 Remote Code Execution

Wavestore VMS version 6.48.809 contains a command injection vulnerability in the venusd /simple/export endpoint. An authenticated remote attacker can inject shell metacharacters into the user parameter, which is URL-decoded and passed without sanitization to a command executed through popen...

PT-2026-80762

Name of the Vulnerable Software and Affected Versions LibreNMS versions 21.6.0 through 26.4.0 Description An authenticated administrator can execute arbitrary operating-system commands on the host server. The issue occurs because the deliverAlert function in LibreNMS/Alert/Transport/Signal.php...

PT-2026-77026

Name of the Vulnerable Software and Affected Versions Microsoft Copilot affected versions not specified Description Improper neutralization of special elements used in a command allows an unauthorized attacker to disclose information over a network. This issue, referred to as CoSnitch, involves a...