vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2026-86330

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

EUVD-2026-88236

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

CVE-2026-86330

An OS command injection flaw exists in the set_hostname_internal function of NooBaa's cluster_internal_api , a component used for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation . The root cause is the direct passing of the hostname parameter to a shell command without proper...

CVE-2026-86330 Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

An OS command injection flaw was found in the sethostnameinternal function of NooBaa's clusterinternalapi. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-95832

A flaw was found in kitty. This vulnerability allows an application writing output to the terminal to execute arbitrary commands in the user's shell. The issue occurs because the color control escape code handler echoes unrecognized field names back into the terminal's input stream without adequa...

CVE-2026-91006

A flaw was found in Apache Karaf. An attacker with access to instance-management commands or Java Management Extensions JMX interfaces can achieve arbitrary command execution on the underlying host system. This issue occurs because user-supplied Java options are spliced directly into child-instan...

USN-8833-1 libvirt-hwe vulnerabilities

It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration...

EUVD-2026-88224

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-78424

Improper parameter handling in NeuVector allows for OS command injection within the privileged enforcer container, potentially leading to a complete compromise of the worker node. This vulnerability affects NeuVector versions 5.4 before 5.4.11 , 5.5 before 5.5.4 , 5.6 before 5.6.2 , and potential...

CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-78424 OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-12268

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...

CVE-2026-12269

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...