PT-2026-97571

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

PT-2026-97551

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: environment-modules (TSSA-2026:1035)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1035 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-93012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...

Linux Distros Unpatched Vulnerability : CVE-2026-82412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and...

CVE-2026-77422: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-93773: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

PT-2026-97264

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

CVE-2026-77601: Improper Neutralization of Special Elements used in an OS Command

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

EUVD-2026-85403

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory. - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path...

Debian dla-4785 : zip - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4785 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-94106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-94367

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

CVE-2026-94367

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

CVE-2026-94367

OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 is vulnerable to an OS command injection in the recbackup component. An authenticated administrator can provide crafted backup-area configuration input that is passed to a shell command, enabling the execution of arbitrary comma...