PT-2026-99812

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi products affected versions not specified Description BUFFALO Wi-Fi products improperly handle input from web forms when assembling internal command line strings. This allows an administrative user to execute arbitrary operating...

CVE-2024-42002

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

Input Leap Arbitrary Command Execution

Missing authentication for a critical function in the input-leapd daemon of Input Leap, the open-source keyboard and mouse sharing tool, allows a local, low-privileged user on Windows to execute arbitrary commands as NT AUTHORITY\SYSTEM by sending a single IPC command message to the daemon's...

PT-2026-99913

WarehousePG WHPG 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability CWE-862 in the built-in server-side file functions pg file writetext,text,bool, pg file renametext,text,text, pg file unlinktext, and pg logdir ls. These functions are executable by any authenticated...

CVE-2026-86530: Improper Neutralization of Special Elements used in an OS Command

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...

CVE-2026-87741: Improper Neutralization of Special Elements used in an OS Command

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

RHEL 8 : postgresql:12 (RHSA-2026:72363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72363 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

RHEL 9 : pcp (RHSA-2026:72272)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72272 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RHEL 10 : pcp (RHSA-2026:72273)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72273 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RHEL 9 : postgresql (RHSA-2026:72281)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72281 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-86102: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

CVE-2026-101091: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

PT-2026-102400

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the /api/ZRQos/set online client endpoint. An attacker can exploit this by manipulating the mac argument to execute arbitrary...

RHEL 8 : postgresql:12 (RHSA-2026:72362)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72362 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-101007: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

PT-2026-99772

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Database Backup Handler component. The issue occurs within the InputSql function located in the class/database.py file. A remote attacker can exploit...

PT-2026-99869

Name of the Vulnerable Software and Affected Versions NooBaa affected versions not specified Description An OS command injection flaw exists in the set hostname internal function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. Th...

CVE-2026-101076: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...