CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Samsung Open Source QA-Board allows : OS Command Injection...

PT-2026-114190

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description Missing authentication for a critical function in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances allows for...

PT-2026-114191

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description An OS command injection flaw exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. This issue occurs du...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

CVE-2026-106931: Improper Neutralization of Special Elements used in an OS Command

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

VulnCheck KEV: CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

VulnCheck KEV: CVE-2026-39949

Cacti ≤ 1.2.30 has an authenticated OS command injection flaw. Users with device and graph template creation privileges can put shell metacharacters in a device’s notes field. Cacti’s variable replacement engine inserts that field, unsanitized, into RRDtool command-line arguments through the...

CVE-2026-105429: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

PT-2026-113819

🚨 CVE-2026-101967 An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response. 🎖@cveNotify...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25111)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-23702)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfiguration action in the API V1 route. This...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25721)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route. This plugin...

Linux Distros Unpatched Vulnerability : CVE-2026-108976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an incomplete list of disallowed inputs...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25196)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi- Fi SSID and/or password fields can lead to remote code execution when the configuration is...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25195)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24452)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25037)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution. This...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20742)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the templates route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20910)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to achieve remote code execution. This plug...

Adobe Experience Manager 2026.0.0 < 2026.9.28386 Multiple Vulnerabilities (APSB26-152)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.9.28386. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-152 advisory. - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in...