CVE-2026-103038 PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

CVE-2026-103038

PingTools Network Utilities 4.64 Free is vulnerable to an OS command injection (CWE-78) within the Watcher ICMP service . The application accepts arbitrary input in the Host field and improperly incorporates it into a command string executed via sh -c . This flaw allows for unauthorized command e...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

EUVD-2026-104392

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an expression injection flaw. The root cause is that AdhocQueryValidator.validate() fails to inspect sub-query expression maps within the orQueries field of TaskQueryDto . This allows authenticated users to bypass ...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

The Television (tv) application, versions 0.15.0 through 0.15.9 , is vulnerable to OS command injection due to improperly escaped single quotes in the format_command function. An attacker can exploit this by planting a file with a crafted name containing an apostrophe; subsequently, triggering an...

EUVD-2026-104310

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400: Vulnerability Analysis, Patch Management, Cyber...

CVE-2026-103038: Improper Neutralization of Special Elements used in an OS Command

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

CVE-2026-109432: Improper Neutralization of Special Elements used in an Expression Language Statement

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

PT-2026-117484

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...

PT-2026-117682

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub 416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa...

CVE-2026-108983: Improper Neutralization of Special Elements used in an OS Command

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

CVE-2026-112159: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-112263: Improper Neutralization of Special Elements used in an OS Command

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112195: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...