CVE-2026-75486

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch function in...

CVE-2026-75121

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The webvlanmembershipeditdialogpost handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated...

CVE-2026-75122

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A...

CVE-2026-75123

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The websmtptestpost handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with...

CVE-2026-55673

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

Exploit for Argument Injection in Gnu Inetutils

Original source:https://github.com/K3ysTr0K3R/CVE-2026-24061...

GHSA-9X44-4GXF-8C25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

GHSA-W23P-WRP7-CH38 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Summary Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource deserializes the hotspots object-store column through the Pimcore\Tool\Serialize::unserialize wrapper without a class allowlist the wrapper's $allowedClasses parameter defaults to true, i.e. fully unrestricted...

GHSA-C9F5-J9C3-MHRG Incus has a project restriction bypass in instance copy across projects

Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they...

Incus has a project restriction bypass in instance copy across projects

Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they...

GHSA-64F3-V33M-W89F Incus has a project restriction bypass for custom volume copy across projects

Summary Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets i...

Incus has a project restriction bypass for custom volume copy across projects

Summary Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets i...

GHSA-JQVF-J3WW-R8C7 PowSyBl Core has Command Injection in LocalCommandExecutor-s

Impact Description Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 OS Command Injection, with a secondary CWE-88 Argument Injection concern via environment variables. The local command executor build command strings via concatenation and executes them through...

PowSyBl Core has Command Injection in LocalCommandExecutor-s

Impact Description Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 OS Command Injection, with a secondary CWE-88 Argument Injection concern via environment variables. The local command executor build command strings via concatenation and executes them through...

CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s

PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...

CVE-2026-55673

PowSyBl (Power System Blocks), a framework for building power system software, is affected by a command injection vulnerability prior to version 7.2.2. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor components concatenate attacker-controlled arguments and environment variables into ...