14718 matches found
CVE-2026-84361: Improper Neutralization of Special Elements used in an OS Command
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...
PT-2026-84129
Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...
CVE-2026-83549: Improper Neutralization of Special Elements used in an OS Command
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...
PT-2026-84157
LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...
PT-2026-84469
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...
VulnCheck KEV: CVE-2026-83549
SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...
CVE-2026-58567: Improper Neutralization of Special Elements used in an OS Command
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...
CVE-2026-58571: Improper Neutralization of Special Elements used in an OS Command
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...
CVE-2026-73716: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...
CVE-2026-73712: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to...
CVE-2026-73720: Improper Neutralization of Special Elements used in an OS Command
Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...
PT-2026-84247
Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...
CVE-2026-59680: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...
CVE-2026-73753: Improper Neutralization of Special Elements used in an OS Command
Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2026-84233: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...
CVE-2026-67394: Improper Neutralization of Special Elements used in an OS Command
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...
PT-2026-84519
Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...
CVE-2026-59681: Improper Neutralization of Special Elements used in an OS Command
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...
CVE-2026-25706: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...
