PT-2026-99139

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists in the export data function within the HorillaListView class located in horilla views/generic/cbv/views.py. The application accepts a columns POST parameter from an authenticated user...

PT-2026-98859

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated attacker can exploit a command injection flaw in the GIM bundle import functionality. By providing a specially crafted GIM bundle, an attacker can pass controlled arguments...

CVE-2026-100382: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

CVE-2026-97863: Improper Neutralization of Special Elements used in an OS Command

The ciscofiresightmanagerACLruleexport module in misp-modules generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values IP address, login, password, domain ID, policy ID and MISP attribute values destination IPs, URL...

Glances secure_popen Command Execution

The vulnerability of the securepopen function in the Glances monitoring tool glances/secure.py is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

BuildKit Command Injection

The vulnerability of the BuildKit container-building software lies in the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-97913

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

FreeRDP RCE

The vulnerability of the RDP client FreeRDP is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

GitPython Command Execution

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Glances virsh Command Execution

The vulnerability of the virsh function in the Glances/plugins/vms/engines/virsh.py module of the monitoring tool Glances is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

GitPython Command Injection

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Vim Command Injection

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-77422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in...

libssh Arbitrary Command Execution

The vulnerability of the libssh library is related to the lack of measures taken to clean data at the administrative level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-97913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not...

Security update for haveged (moderate)

openSUSE security update: security update for haveged ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21958-1 Rating: moderate References: bsc1264086 Cross-References: CVE-2026-41054 CVSS scores: CVE-2026-41054 SUSE : 7.8...

CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

CVE-2026-85082

The Root Browser Classic 3.3.0 application is vulnerable to an OS command injection due to the improper handling of SQLite database paths. The application passes the file path of a selected database to an operating-system shell without ensuring the filename is safely separated from the command. T...

CVE-2026-85082 Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...