CVE-2026-112195: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...

CVE-2026-112301: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

PT-2026-117448

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-111853

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

CVE-2026-111853

Tektronix 3 Series MDO devices running firmware versions before 1.21.1 are susceptible to an OS command injection vulnerability. The flaw resides in the FILESystem:MOUNT:DRIve SCPI command handler , where insufficient neutralization of user-supplied input allows remote attackers to execute arbitr...

EUVD-2026-103206

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

CVE-2026-111853

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

CVE-2026-111853: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...

Linux Distros Unpatched Vulnerability : CVE-2026-102607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlle...

Vedo Suite 1.2.5 SQL Injection

Vedo Suite version 1.2.5 contains an authenticated SQL injection issue in its chat API endpoint that may permit operating-system command execution through an enabled SQL Server xpcmdshell configuration...

PT-2026-116193

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description An OS command injection issue exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2026-110642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped...

SUSE CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

Exploit for OS Command Injection in Gnu Bash

CVE-2014-6271 Shellshock xpl0ited by infrar3dhttps://githu...

CVE-2026-108743

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743 Apache Kylin: spark job OS command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-108743

The Apache Kylin big data processing framework is vulnerable to an OS Command Injection (CWE-78) flaw in versions 4.0.4 through 5.0.4 . The vulnerability allows for the improper neutralization of special elements used in OS commands, specifically affecting spark jobs . This issue primarily impact...

EUVD-2026-103156

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...