PT-2026-105589

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei...

CVE-2026-12405: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-103248: Improper Neutralization of Special Elements used in an SQL Command

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters String mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update...

PT-2026-103918

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description OS command injection flaws exist in the foreman-rake db:dump and db:import dump tasks. The application does not properly sanitize user-supplied input in the destination parameter during backu...

PT-2026-103917

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description A command injection flaw exists in the foreman-rake errors:fetch log task. The request id parameter is passed to an underlying system command, typically grep, without adequate shell...

PT-2026-103915

Name of the Vulnerable Software and Affected Versions rubygem-foreman remote execution affected versions not specified Description A command injection flaw exists in the Red Hat Satellite API endpoint '/api/v2/job invocations'. The issue occurs when a job template has the effective user property...

PT-2026-103958

Name of the Vulnerable Software and Affected Versions rubygem-hammer cli affected versions not specified Description Command injection is possible in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite. The issue occurs because the $EDITOR environment variable is...

PT-2026-103957

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description The foreman-tail utility is susceptible to OS command injection resulting from the unsafe implementation of the eval command. The script incorporates user-supplied arguments into a string...

CVE-2026-103505: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-71451: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63...

PT-2026-103681

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

PT-2026-103952

Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...

CVE-2026-51897: Undefined Security Weakness

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-102369: Improper Authentication

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

PT-2026-105790

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

CVE-2026-79898: Improper Neutralization of Special Elements used in an OS Command

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

game-music-emu 0.6.5 VGM Command Interpreter Out-Of-Bounds Read / DoS

An out-of-bounds read in the VGM command interpreter of game-music-emu libgme, the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to crash the hosting process or to have adjacent heap memory influence the rendered audio, via a PCM seek...

game-music-emu 0.6.5 VGM Command Interpreter Missing Operand Out-Of-Bounds Read

An out-of-bounds read in the VGM command interpreter of game-music-emu libgme, the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to read heap memory past the end of the buffer holding the file. The read happens as soon as playback...

PT-2026-105791

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

PT-2026-103977

Name of the Vulnerable Software and Affected Versions Archer AX90 V1 affected versions not specified Description An unauthenticated adjacent-network attacker can execute arbitrary operating system commands with root privileges during device boot. This is possible by exploiting the setProductVer...