CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

PT-2026-136126

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install mib function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec. ...

CVE-2026-95725: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A command injection vulnerability exists in the VIA client for Linux

A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system...

CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

CVE-2026-121548: jarun nnn: Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to…

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

CVE-2026-121621: Red Hat Red Hat OpenShift GitOps: A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git…

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and...

Linux Distros Unpatched Vulnerability : CVE-2026-119025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows an...

ROS-20261103-73-0075

A vulnerability in Python 3 related to insufficient neutralization of special elements in requests. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

PT-2026-136335

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

PT-2026-136186

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo tool configuration path or stereo tool license key, which are executed via...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4954-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4954-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-11856: cross-origin Dige...

PT-2026-136695

An authenticated OS command injection vulnerability exists in the Offline Download component USB storage allocation of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly...

AlmaLinux 8 : perl:5.32 (ALSA-2026:85917)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:85917 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

CVE-2026-82155: Dell OS Recovery tool: Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution...

Rocky Linux 8 [CIQ] Security Update: perl / perl-Algorithm-Diff / perl-Archive-Tar / perl-Archive-Zip / etc (crlsa-2026_85917)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685917 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

CVE-2026-38595

A vulnerability in im3x Scriptables (v2-dev branch) allows attackers to perform arbitrary OS command injection . This occurs when a user uploads a file with a crafted filename to the /sync endpoint . The provided documents do not specify a remediation, exploit details, or specific versions for th...

PT-2026-136272

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

PT-2026-136303

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint...

PT-2026-136222

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

UBUNTU-CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to...