CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

UBUNTU-CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs versions prior to 31.2 (and TRAMP through 2.8.2 ) are vulnerable to OS command injection via a filename. The root cause is an incomplete list of disallowed inputs within the tramp-user-regexp, stemming from an incomplete fix for CVE-2026-79992. This vulnerability allows for potential un...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108744

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108576

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

EUVD-2026-96909

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108744

The pbi-cli tool, versions 3.10.1 through 3.12.0 , is vulnerable to an OS command injection within the desktop_sync.py component. The root cause is the passing of unquoted .pbip paths to cmd /c start when reopening projects. An attacker can lure a victim into opening a Power BI project from a spa...

CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injection

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

EUVD-2026-96983

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function processping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about th...

CVE-2026-108576

A critical OS command injection vulnerability exists in TOZED X300 (versions up to 6.01.3 ). The flaw is located within the process_ping function of the IPPingDiagnostics Handler component. An attacker can achieve remote code execution by manipulating the Host argument. The impact is severe, with...

CVE-2026-108540

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

EUVD-2026-96778

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-108540

A vulnerability exists in OpenSpug Spug up to versions 3.4.0/4.0.1 within the File Transfer component. The flaw impacts an unknown function of the /exec/transfer file, where improper neutralization of special elements allows for os command injection . This vulnerability can be triggered via a rem...