CVE-2026-46449

The Akamai Guardicore Platform Agent (GPA) for macOS versions prior to 7.4 is vulnerable to a local privilege escalation via a command injection flaw in the wapptunneld component. The root cause is a lack of input validation when the service uses network interface names to execute system utilitie...

PT-2026-114078

pypdftk through 0.5 contains an OS command injection vulnerability in fill form, dump data fields, and pdftk cmd util that builds shell commands from caller-supplied paths. Attackers controlling pdf path or out file can inject shell metacharacters interpreted by subprocess.Popen with shell=True t...

PT-2026-114083

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress file. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shel...

PT-2026-114090

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child process.execSync, so shell metacharacte...

PT-2026-114076

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

Decepticon 1.4.4

Decepticon is an AI-powered autonomous red team framework designed to automate penetration testing and adversary simulation. It integrates AI agents with security tools to perform reconnaissance, vulnerability discovery, exploitation, and post-exploitation activities. The framework supports...

PT-2026-114336

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver handler deserialization is vulnerable because the receive handler uses FW ASSERT for externally influenced deserialization...

PT-2026-114382

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND LINE SIZE. In that case append ipl block parm passes a zero size to the IPL parameter conversion helpers an...

PT-2026-114081

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

PT-2026-114328

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-113872

An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled...

PT-2026-114087

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

PT-2026-114194

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protoco...

PT-2026-114218

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

PT-2026-114091

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

MiracleLinux 8 : kernel-4.18.0-553.171.1.el8_10 (AXSA:2026-2037:98)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2037:98 advisory. kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition CVE-2025-39994 kernel: gfs2: Fix unlikely race in gdlmputlock...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...

Copeland XWEB Pro OS Command Injection (CVE-2026-20764)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote...

Copeland XWEB Pro OS Command Injection (CVE-2026-24663)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body. This plugin...

RockyLinux 9 : dovecot (RLSA-2026:80825)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80825 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...