CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

A vulnerability in the Multilang adminbin allows for arbitrary command execution due to insufficient validation . This flaw is associated with CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability has a CRITICAL severity score of 9.9 , indicating a high imp...

Barco/AWIND OEM Presentation Platform - Remote Command Injection

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pr...

MovableType - Remote Command Injection

MovableType 5002 and earlier Movable Type Advanced 7 Series, Movable Type Advanced 6.8. 2 and earlier Movable Type Advanced 6 Series, Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection

The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

F5 iControl REST - Remote Command Execution

F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before...

EUVD-2026-91064

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-51911: Undefined Security Weakness

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-82041: Missing Authorization

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

PT-2026-104374

Name of the Vulnerable Software and Affected Versions AgentScope version 1.0.20 Description Code injection exists in the execute shell command function located in src/agentscope/tool/ coding/ shell.py. Depending on the exposed entry, an attacker can trigger the execution of attacker-controlled co...

PT-2026-104410

Name of the Vulnerable Software and Affected Versions Nx versions 21.4.0 through 22.7.7 Nx versions 23.0.0 through 23.1.0 Description The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values...

CVE-2026-105050: Incorrect Behavior Order: Validate Before Canonicalize

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...

PT-2026-104453

Name of the Vulnerable Software and Affected Versions PeaZip versions prior to 11.3.0 Description In a non-default configuration, the software is susceptible to OS command injection. This occurs when a filename within an archive is processed and the application mishandles cases where a quotation...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

PT-2026-104442

Name of the Vulnerable Software and Affected Versions Digi DAL OS affected versions not specified Description An OS Command Injection flaw exists in the web administration interface. An unauthenticated attacker can send a specially crafted HTTP POST request to execute arbitrary operating system...

PT-2026-104588

Name of the Vulnerable Software and Affected Versions act runner affected versions not specified Description The act runner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When privileged mode is disabled, the system only forces the...

CVE-2026-75937: Improper Neutralization of Special Elements used in an OS Command

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...