PT-2026-106747

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)

: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

CVE-2026-105797: Improper Neutralization of Special Elements used in an OS Command

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-101207: Improper Neutralization of Special Elements used in an OS Command

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...

CVE-2026-102160: Improper Neutralization of Special Elements used in an OS Command

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

PT-2026-106746

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

PT-2026-106300

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description An OS command injection flaw exists in the UploadFirmwareFile Handler component. A remote, unauthenticated attacker can exploit this by manipulating the file name parameter within the...

PT-2026-107146

An operating system OS command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service...

CVE-2026-105793: Improper Neutralization of Special Elements used in an OS Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the presskey tool in ufo/client/mcp/httpservers/mobilemcpserver.py accepts a free-form keycode parameter and passes it to adb shell input keyevent. The adb client joins the arguments...

CVE-2026-91140: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

PT-2026-106726

Name of the Vulnerable Software and Affected Versions lrzsz versions prior to 0.13.0 Description The lrz receive utility contains an OS command injection flaw in its pipe mode. This occurs when lrz is executed under a suffixed name, such as lrztar, causing the procheader function in src/lrz.c to...

PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

CVE-2026-105484: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105841: Improper Neutralization of Special Elements used in an OS Command

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

PT-2026-115843

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-85523: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

simple-git allows command execution through unblocked Git configuration includes

Summary An OS command injection vulnerability in git.clone allows any application that flows attacker-influenced data into customArgs to execute arbitrary code. simple-git 3.36.0 current latest on npm ships without any include.path entry in the blockUnsafeOperationsPlugin denylist. Passing -c...

@nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

GHSA-6VC5-VF29-FFR2 @nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...