CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

Multiple vulnerabilities in Lite-On O-RU "FF-RFI079I4" and "FF-RFI078I4"

Overview O-RU "FF-RFI079I4" and "FF-RFI078I4" provided by LITE-ON Technology Corporation contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-77853 Hidden Functionality CWE-912 - CVE-2026-80217 Yuto Aono, Yutaro Osako, and Shunsuke Saruwatari of The University of...

CVE-2026-57133: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to childprocess.exec. A string that starts...

PT-2026-92450

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in a component allows an authenticated remote attacker to execute arbitrary commands by providing specially crafted input. Successful exploitation ca...

CVE-2026-76691: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-55158: Improper Neutralization of Special Elements used in an OS Command

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...

PT-2026-93169

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

PT-2026-91900

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-14276 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...

EUVD-2026-78149

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...

CVE-2026-16466

CVE-2026-16466 affects IBM DataStage on Cloud Pak for Data version 5.4.0.0 , where an OS command injection flaw (CWE-78) allows a remote authenticated attacker to execute arbitrary commands with a CVSS score of 8.8 (HIGH) , impacting confidentiality, integrity, and availability. The vulnerability...

CVE-2026-16466 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

CVE-2026-16673

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability where improper neutralization of special characters in the PxPeek name property allows a remote authenticated attacker to execute arbitrary OS commands . The CVSS 3.1 score is 8.8 (High) with a network vector, low complexity, an...

rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...

CVE-2026-59960

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

Environment Module Command Injection Vulnerability

Environment modules have a command injection vulnerability. This vulnerability arises when a local attacker places a maliciously named modulefile in a visible location within the victim’s MODULEPATH. When the victim uses Bash completion for the module or the ml command, the malicious module name,...

CVE-2026-57125

PraisonAI is a multi-agent teams system exposed as pip packages praisonai and praisonaiagents. The vulnerability chains two weaknesses: the POST /api/v1/runs Jobs API endpoint lacks authentication (missing Depends(verify_token)), and an attacker-controlled approve field in the submitted workflow ...