PT-2026-114190

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description Missing authentication for a critical function in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances allows for...

PT-2026-114032

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L version 2.01b05 Description The HNAP CGI Handler component contains a flaw in the system function within the /htdocs/cgibin file. A remote attacker can perform OS command injection by manipulating the SOAPACTION argument. OS...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-110636: Improper Neutralization of Special Elements used in an OS Command

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-106931: Improper Neutralization of Special Elements used in an OS Command

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

ModelScope MS-Agent 1.5.1 < 1.6.0 Command Injection (CVE-2026-2256)

The version of ModelScope MS-Agent installed on the remote host is 1.5.1 or later but prior to 1.6.0. It is, therefore, affected by a command injection vulnerability. The Shell tool runs commands on the host through a shell, guarded only by a regex denylist that can be bypassed, allowing an...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-21389)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route. This plugin only works with Tenable.ot. Please...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25105)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route. This plugin only works with Tenable.ot...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24663)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body. This plugin...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24517)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24689)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update apply action. This plugin only works with Tenable.ot...

PT-2026-114315

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description Enabling CURLOPT CRLF allows for command injection during IMAP APPEND operations. When transmitting line-ending expanded data, curl advertises the raw input byte count in the IMAP APPEND N...

Adobe Experience Manager 2026.0.0 < 2026.9.28386 Multiple Vulnerabilities (APSB26-152)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.9.28386. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-152 advisory. - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in...

EUVD-2026-100804

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-105429: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

PT-2026-113915

🚨 CVE-2026-102079 An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This...

PT-2026-114271

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

PT-2026-113643

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device...

PT-2026-113648

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

PT-2026-113781

🚨 CVE-2026-101216 Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote executio...