189171 matches found
CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16469
The IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime is vulnerable to an issue where a remote authenticated attacker could execute arbitrary commands. This is caused by the improper neutralization of special elements used in an OS command . The CVSS 3.1 score is 8.8 (High) with a network at...
CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16468 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...
CVE-2026-16468
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection , which could allow a remote authenticated attacker to execute arbitrary commands. The provided documents do not specify the exact component or function responsible for the injection, nor do they provide details on ...
CVE-2026-16468 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...
CVE-2026-16346 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-16346
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an OS command injection flaw (CWE-285 ). A remote authenticated attacker can execute arbitrary commands due to the improper neutralization of special elements used in an OS command. This vulnerability has a CRITICAL base severity score ...
CVE-2026-16346 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
GHSA-JPF4-98QJ-QR67 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
Impact The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command. An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could...
EUVD-2026-84003
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API...
GHSA-5JPJ-293F-RHVJ KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
Impact The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command. An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could...
Timing Attack
Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
Description KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes. The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update...
GHSA-M3C6-2P7H-CFR3 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
Description KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes. The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update...