CVE-2026-95519: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

PT-2026-104949

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD FLAG HW ACCESSIBLE. HCD FLAG HW ACCESSIBLE is set and cleared in suspend and...

CVE-2026-97430

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

CVE-2026-97430: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

CVE-2026-97430: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

PT-2026-98064

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xhci component where new commands could be queued on the command ring even when the xHC is marked as inaccessible. This state is managed by the HCD FLAG HW...

ROS-20260924-73-0001

The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-98268

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-93289: Improper Neutralization of Special Elements used in an OS Command

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

PT-2026-98038

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description Deserialization of untrusted data in the command monitoring support allows class names embedded in document content to be honored during the construction of monitoring event object...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libgit2 vulnerability (USN-8809-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8809-1 advisory. Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using th...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Critical) (RHSA-2026:71114)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71114 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Linux Distros Unpatched Vulnerability : CVE-2026-97430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the...

CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-82370

Brocade SANnav versions before 3.0.1a are vulnerable to an unauthenticated remote command injection in the orchestrator HTTP service. This flaw allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Potential impacts ...

Exploit for CVE-2026-95675

CVE-2026-95675 - D-Link DAP-1360 !https://threataft.com/im...

CVE-2026-81537

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

automation-controller: automation-controller: incomplete sanitize_jinja() regex allows Jinja template injection into ad-hoc module_args, Machine-credential fields, and Host names, reaching ansible-core templating in the execution environment

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...