18627 matches found
CVE-2026-109432: Improper Neutralization of Special Elements used in an Expression Language Statement
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...
PT-2026-117484
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...
CVE-2026-108983: Improper Neutralization of Special Elements used in an OS Command
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...
PT-2026-117682
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub 416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa...
CVE-2026-112263: Improper Neutralization of Special Elements used in an OS Command
Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...
CVE-2026-112195: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...
CVE-2026-112301: Improper Neutralization of Special Elements used in an OS Command
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...
PT-2026-117448
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...
CVE-2026-112159: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...
CVE-2026-111853
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...
CVE-2026-111853
Tektronix 3 Series MDO devices running firmware versions before 1.21.1 are susceptible to an OS command injection vulnerability. The flaw resides in the FILESystem:MOUNT:DRIve SCPI command handler , where insufficient neutralization of user-supplied input allows remote attackers to execute arbitr...
EUVD-2026-103206
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...
CVE-2026-111853
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...
CVE-2026-111853: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with...
Linux Distros Unpatched Vulnerability : CVE-2026-102607
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlle...
Vedo Suite 1.2.5 SQL Injection
Vedo Suite version 1.2.5 contains an authenticated SQL injection issue in its chat API endpoint that may permit operating-system command execution through an enabled SQL Server xpcmdshell configuration...
PT-2026-116193
Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description An OS command injection issue exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrar...
Linux Distros Unpatched Vulnerability : CVE-2026-110642
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped...
SUSE CVE-2026-105841
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...
