Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-21389)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route. This plugin only works with Tenable.ot. Please...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20902)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route. This plugin only work...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24517)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route. This plugin only works with Tenable.ot. Please visit...

CVE-2026-110005

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-103848

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-103848 Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-103848

Adobe Experience Manager is vulnerable to an OS Command Injection (CWE-78) caused by the improper neutralization of special elements used in an OS command. A low-privileged attacker can exploit this vulnerability to achieve arbitrary code execution in the context of the current user. This exploit...

CVE-2026-110005

The Komodo server management platform, specifically the periphery agent's container-management functionality, contains an OS command injection vulnerability (CWE-78) in versions prior to 2.3.0 (verified in v2.2.0, v2.1.2, v2.1.1, v2.1.0, v2.0.0, and v1.19.1). The root cause is the lack of proper ...

CVE-2026-110005 Moghtech Komodo contains an OS command injection vulnerability

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-110005 Moghtech Komodo contains an OS command injection vulnerability

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

DEBIAN-CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110233

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

UBUNTU-CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-104584

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-100207

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

EUVD-2026-100318

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-100207

A vulnerability in Azure CycleCloud involving improper neutralization of special elements used in an OS command (OS command injection) allows an authorized attacker to execute code locally . This flaw is associated with CWE-78 and has a CVSS 3.1 base score of 7.3 . While the vulnerability was ide...

CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-110236

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...