VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

Linux Distros Unpatched Vulnerability : CVE-2026-62943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch...

CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

The vulnerability of the setSmartQosCfg function in the microprogramming software of TOTOLINK A3300R routers allows a intruder to execute arbitrary commands.

The vulnerability of the setSmartQosCfg function in TOTOLINK A3300R router microprogramming systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the failure to take measures to clean data at the management level, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information or execu...

PT-2026-95957

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.26 Description An OS command injection flaw exists in shell-out handlers that fail to properly escape filenames before incorporating them into command strings. Attackers can use filenames containing shell...

CVE-2026-82892

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-84083 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmapwrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands...

CVE-2026-84083 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmapwrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands...

CVE-2026-84071 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-82892 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-82892

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection caused by improper neutralization of special elements in an OS command, allowing a remote attacker to execute arbitrary commands. The flaw requires no prior authentication or user interaction but has a high attack complexity ...

EUVD-2026-83313

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-62943

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

CVE-2026-62943 btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

PT-2026-95491

Name of the Vulnerable Software and Affected Versions btrbk versions 0.29.0 through 0.32.6 Description The ssh filter btrbk.sh script constructs allow stream match using a start anchor but lacks an end-of-string anchor for the complete command. This allows a user restricted by an authorized keys...

CVE-2026-62943: Improper Neutralization of Special Elements used in an OS Command

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced comma...

CVE-2026-93605: Protection Mechanism Failure

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

PT-2026-95676

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...

EUVD-2026-82379

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...