CVE-2026-58567: Improper Neutralization of Special Elements used in an OS Command

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-59681: Improper Neutralization of Special Elements used in an OS Command

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

CVE-2026-25706: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

PT-2026-84519

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...

PT-2026-84247

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

CVE-2026-59680: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-67394: Improper Neutralization of Special Elements used in an OS Command

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-84233: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-73712: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to...

CVE-2026-73720: Improper Neutralization of Special Elements used in an OS Command

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73753: Improper Neutralization of Special Elements used in an OS Command

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73716: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...

CVE-2026-79408

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...

CVE-2026-82703

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component aspsetPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The...

CVE-2026-82702

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component aspWlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-59111

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

SUSE-SU-2026:3901-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.6.3. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

SUSE-SU-2026:3895-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.5.5. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

SUSE-SU-2026:3894-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.4.6. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

CVE-2026-82703 Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component aspsetPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The...