Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

HPESBHF05153 rev.1 - HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution

Potential Security Impact: Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to 1.77.30 HPE Compute Scale-up Server 3250 - Prior to 1.03.38 HPE Superdome Flex 280 Server - Prior to 2.17.03 HPE Superdome Fle...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1787680122)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787680122 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the...

PT-2026-103951

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR841N affected versions not specified Description An authenticated OS command injection exists in the IPv6 WAN configuration. This occurs when a crafted value provided to the IPv6 Gateway is improperly incorporated into a system...

PT-2026-103798

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

PT-2026-104822

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

CVE-2026-12545: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

CVE-2026-71452: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63...

ROS-20261001-73-0049

The vulnerability in rclone relates to the failure to take measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-84682: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

CVE-2026-14157: Use of Externally-Controlled Format String

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...

CVE-2026-12542: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

CVE-2026-12540: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

PT-2026-103958

Name of the Vulnerable Software and Affected Versions rubygem-hammer cli affected versions not specified Description Command injection is possible in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite. The issue occurs because the $EDITOR environment variable is...

CVE-2026-51897: Undefined Security Weakness

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2024:1728055873)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728055873 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789466646)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789466646 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1784042868)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1784042868 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777889241)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777889241 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows...