Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows

: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

CVE-2026-105487: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

PT-2026-107333

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper input validation leads to the improper neutralization of special elements used in an OS command, allowing a remote authenticated attacker to perform code injection and execute...

PT-2026-106746

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-105841: Improper Neutralization of Special Elements used in an OS Command

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105788: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

PT-2026-106726

Name of the Vulnerable Software and Affected Versions lrzsz versions prior to 0.13.0 Description The lrz receive utility contains an OS command injection flaw in its pipe mode. This occurs when lrz is executed under a suffixed name, such as lrztar, causing the procheader function in src/lrz.c to...

PT-2026-115843

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

PT-2026-106736

Name of the Vulnerable Software and Affected Versions Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator versions prior to 2.1 Description An OS command injection flaw exists in the shell-based temporary-file cleanup instructions. An attacker can execute arbitrary command...

CVE-2026-34498: Improper Input Validation

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

PT-2026-106747

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-105797: Improper Neutralization of Special Elements used in an OS Command

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-101207: Improper Neutralization of Special Elements used in an OS Command

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...

CVE-2026-102160: Improper Neutralization of Special Elements used in an OS Command

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

PT-2026-107146

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

CVE-2026-105793: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-91140: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105484: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

PT-2026-106300

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description An OS command injection flaw exists in the UploadFirmwareFile Handler component. A remote, unauthenticated attacker can exploit this by manipulating the file name parameter within the...