The vulnerability of the TOPAZ Metron PTS time synchronization device, related to the failure to implement measures to neutralize special elements, allows intruders to inject arbitrary OS commands.

The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...

EUVD-2026-98316

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-75826

A command injection vulnerability exists in the backup function of Teltonika Networks devices. This flaw allows a remote authenticated attacker to execute arbitrary OS commands. Affected software includes RUTOS 7.22 (before 7.24.6 for most devices; before 7.25.2 for TAP devices), RUTOS 7.25 (befo...

CVE-2026-75826 Teltonika Command Injection in Backup function

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

CVE-2026-89116

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

EUVD-2026-94122

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-97674 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1789602943)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789602943 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1789602943)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789602943 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2020_4453)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204453 advisory. vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 Tenable has extracted the preceding description blo...

PT-2026-103498

Name of the Vulnerable Software and Affected Versions Deno versions 2.7.0 through 2.9.7 Description On Windows, a command injection issue exists in the node:child process module. The escapeShellArg function incorrectly applies POSIX rules instead of Windows cmd.exe rules, which fails to neutraliz...

CVE-2026-87969

A WatchGuard AP OS command injection vulnerability exists within the diagnostic CLI . An authenticated administrator can execute arbitrary operating system commands by providing crafted input. While the technical root cause is not detailed beyond the input handling flaw, the impact allows for ful...

CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

CVE-2026-96795

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...