189015 matches found
CVE-2026-87900: Improper Neutralization of Argument Delimiters in a Command
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...
CVE-2026-79310
webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...
PT-2026-97571
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...
PT-2026-97551
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...
PT-2026-97392
Name of the Vulnerable Software and Affected Versions Frictionless versions prior to 5.20.0rc1 Description An OS command injection flaw exists in the explore console command. An attacker can execute arbitrary operating system commands by providing a crafted Data Package descriptor. By placing she...
PT-2026-97240
Name of the Vulnerable Software and Affected Versions CGServiSign affected versions not specified Description An OS Command Injection flaw exists in CGServiSign. Unauthenticated remote attackers can trick victims into visiting a malicious web page to inject arbitrary operating system commands...
PT-2026-97595
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...
CVE-2026-77601: Improper Neutralization of Special Elements used in an OS Command
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...
PT-2026-97543
Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description An input-validation flaw exists in the sanitize jinja function. The function employs two regular expressions to reject user-supplied Jinja, but these patterns stop at the first...
PT-2026-97523
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.12.0 through 7.2.9 Description An authenticated actor can execute arbitrary operating system commands as the openc3 service user. The issue occurs when the set setting method at the POST /openc3-api/api endpoint is use...
CVE-2026-50227: Missing Authentication for Critical Function
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...
Linux Distros Unpatched Vulnerability : CVE-2026-82412
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and...
Debian dla-4785 : zip - security update
The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4785 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/...
CVE-2026-94367
OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 is vulnerable to an OS command injection in the recbackup component. An authenticated administrator can provide crafted backup-area configuration input that is passed to a shell command, enabling the execution of arbitrary comma...
CVE-2026-94367
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...
CVE-2026-94367
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...
CVE-2026-16672
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...