CVE-2026-70375

CVE-2026-70375 : HashBrown CMS <1.4.6 has an OS Command Injection in the Git deployer. GitDeployer.pullRepo() runs AppService.exec(git checkout ${this.branch || 'master'}) with the branch value interpolated directly, and GitDeployer.validate() only rejects a single quote in repo/branch/usernam...

CVE-2026-17347

A flaw was found in pgAdmin 4. The MASTERPASSWORDHOOK setting, which allows administrators to configure an external command for per-user encryption keys, improperly substitutes usernames into the command string. An authenticated user can exploit this by providing a specially crafted username...

EUVD-2026-52482

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

CVE-2026-52102

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

SUSE CVE-2026-54090

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured e.g. /bin/sh -c, the command allowlist can be bypassed through shell metacharacters. The allowlist...

EUVD-2026-50969

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

EUVD-2026-46397

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

EUVD-2026-46388

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

CVE-2026-64881

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

CVE-2026-64878

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

CVE-2026-64879

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-64881 Command Injection

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

CVE-2026-64878

CVE-2026-64878 is a command-injection vulnerability described as unvalidated input in asset filter parameters that allows shell metacharacters to escape command argument handling, enabling remote code execution on a low-privileged OS user via the Analysis REST endpoint. The connected Tenable advi...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

CVE-2026-59846 affects libssh: a flaw in ProxyCommand handling where a malicious username expanded via %r can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. No specific exploit/public-fix details are provided in the connected documents; remediat...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

EUVD-2026-46254

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...