CVE-2026-82155: Dell OS Recovery tool: Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-121621: Red Hat Red Hat OpenShift GitOps: A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git…

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required...

CVE-2026-38595

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint...

Nebula AI-Powered Penetration Testing 3.0.40

Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...

CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

PT-2026-136126

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install mib function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec. ...

CVE-2026-95725: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A command injection vulnerability exists in the VIA client for Linux

A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system...

CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

PT-2026-136695

An authenticated OS command injection vulnerability exists in the Offline Download component USB storage allocation of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly...

CVE-2026-121548: jarun nnn: Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to…

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

CVE-2026-38595

A vulnerability in im3x Scriptables (v2-dev branch) allows attackers to perform arbitrary OS command injection . This occurs when a user uploads a file with a crafted filename to the /sync endpoint . The provided documents do not specify a remediation, exploit details, or specific versions for th...

PT-2026-136186

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo tool configuration path or stereo tool license key, which are executed via...

PT-2026-136222

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

PT-2026-136272

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

PT-2026-136303

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint...

PT-2026-136335

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

UBUNTU-CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...

Rocky Linux 8 [CIQ] Security Update: perl / perl-Algorithm-Diff / perl-Archive-Tar / perl-Archive-Zip / etc (crlsa-2026_85917)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685917 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4954-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4954-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-11856: cross-origin Dige...