PT-2026-97069

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

PT-2026-97067

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description The px-runtime component contains a flaw where special elements used in OS commands are not properly neutralized. This allows a remote authenticated attacker to execute arbitrary...

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-95660: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

NotepadPlusPlus: CVE-2026-85288: Improper Neutralization of Special Elements used in an OS Command

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...

CVE-2026-65130: Improper Neutralization of Special Elements used in an OS Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

NPM vm2 Arbitrary Command Execution

The vulnerability of the NPM package manager’s vm2 library is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002329 advisory. Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. Tenable ha...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: sssd (UTSA-2026-090441)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090441 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. This flaw allows an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2023-002897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002897 advisory. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. ...

PT-2026-96753

Name of the Vulnerable Software and Affected Versions NVIDIA Infrastructure Controller for Linux affected versions not specified Description An issue exists that allows an attacker to perform OS command injection. This could lead to arbitrary code execution, data tampering, denial of service, and...

PT-2026-97114

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description An OS command injection issue exists in the recbackup component. An authenticated administrator can provide specially crafted backup-area configuration input th...

PT-2026-96932

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

PT-2026-96807

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description...

PT-2026-96856

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The updater plugin contains a flaw where the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true, the...

PT-2026-96801

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 versions prior to 9.7.0.2 Lantronix EMG8500 versions prior to 9.7.0.1 Lantronix EMG7500 versions prior to 9.7.0.1 Lantronix SLB882 affected versions not specified Lantronix SLCx-03 affected versions not specified Lantronix...

PT-2026-96321

Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description An OS command injection flaw exists in the Command API component within the executeSystemCommand function of the src/octoprint/server/api/system.py file. A remote attacker can exploit this by manipulating th...

PT-2026-96920

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An OS command injection exists in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific...

PT-2026-96808

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description...

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in sshconfig...