CVE-2026-104586

The AUTOM8N WHM/cPanel plugin (through commit 82821f7 ) is vulnerable to an OS Command Injection within the borg_restore.cgi script. The root cause is the unsanitized concatenation of HTTP GET/POST form parameters into system commands executed via subprocess.Popen(cmd, shell=True). Because CGI sc...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-96893)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

PT-2026-114432

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse webpage, search web, and torrent metadata parsers, which then get passed to the...

PT-2026-114440

Name of the Vulnerable Software and Affected Versions Netgate pfSense FRR package pfSense-pkg-frr versions 2.0.2 1 and 2.1.2 1 Description An authenticated WebGUI user with page-status-frr privileges can perform OS command injection through the FRR status filter. The issue occurs when a filter...

PT-2026-115181

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

PT-2026-115183

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

PT-2026-115190

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

PT-2026-115191

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

PT-2026-115194

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services captiveportal hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected users with shel...

CVE-2026-109971

A flaw was found in the clevis PKCS11 pin. The clevis-decrypt-pkcs11 script passes the PKCS11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

Linux Distros Unpatched Vulnerability : CVE-2026-110858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not...

Oracle Linux 8 : environment-modules (ELSA-2026-82919)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-82919 advisory. 4.5.2-5 - Fix command injection in bash Tab completion via compgen -W expansion CVE-2026-85013 Tenable has extracted the preceding description block directly...

Security Update for Microsoft Visual Studio Code (October 2026)

The remote host has an application installed that is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. CVE-2026-102235 - Improper...

MiracleLinux 9 : kernel-5.14.0-687.47.1.el9_8 (AXSA:2026-2048:99)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2048:99 advisory. kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: drm/xe:...

PT-2026-114953

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE2-A versions prior to 2026-09-24-841a51c6d5 tclinux.bin Description An OS command injection flaw exists in the Login Processing component within the sub 12580 function of the api.cgi file. A remote attacker can exploit this b...

PT-2026-114950

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borg restore.cgi...

PT-2026-114900

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4660-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4660-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: -...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4668-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4668-1 advisory. The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues: The following security issues were fixed: -...