CVE-2026-73720: Improper Neutralization of Special Elements used in an OS Command

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73751: Improper Neutralization of Special Elements used in a Command

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

CVE-2026-58571: Improper Neutralization of Special Elements used in an OS Command

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-73716: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...

PT-2026-84157

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-73712: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to...

PT-2026-84519

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...

PT-2026-84315

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

CVE-2026-73709: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacke...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

CVE-2026-84194: Improper Neutralization of Special Elements used in an OS Command

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-73753: Improper Neutralization of Special Elements used in an OS Command

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-67394: Improper Neutralization of Special Elements used in an OS Command

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-58567: Improper Neutralization of Special Elements used in an OS Command

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-83549: Improper Neutralization of Special Elements used in an OS Command

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

VulnCheck KEV: CVE-2026-83549

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

PT-2026-84213

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An OS Command Injection issue exists, which occurs when an application fails to properly neutralize special elements used in an OS command. This could allow the...

PT-2026-84247

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

CVE-2026-59681: Improper Neutralization of Special Elements used in an OS Command

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...