SiteGuard Server Edition vulnerable to OS command injection

Overview SiteGuard Server Edition provided by EG Secure Solutions Inc. is a host-based Web Application Firewall WAF designed to be integrated into a web server. The statistics feature of SiteGuard Server Edition contains the following vulnerability: OS command injection CWE-78 - CVE-2026-106931...

CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CURL-CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-105106

The Koha library is vulnerable to OS command injection within the Task Scheduler deletion path. The tools/scheduler.pl handler accepts a jobid parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without proper validation. Specifically, Schedule::At::remove substitutes the un...

CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

EUVD-2026-100897

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control VulnerabilityAn improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-21998 DESCRIPTION: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8...

UBUNTU-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

CVE-2026-46449

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-110455

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

EUVD-2026-100816

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

CVE-2026-110455

The UniFi Protect AI Key is vulnerable to an Improper Input Validation flaw. A malicious actor with network access could exploit this under specific conditions to perform a Command Injection on the device. No specific remediation information or exploit details are provided in the documents.

CVE-2026-106931

SiteGuard Server Edition versions 2.20 through 8.00 Update4 contain an OS command injection vulnerability within the statistics feature, which is enabled by default. A local attacker with low-privileged account access can exploit this flaw to execute arbitrary commands with root or SYSTEM privile...