PT-2026-111311

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN592AX6 version 250422 Description A flaw in the wmapd Daemon allows for remote OS command injection. The issue resides within the system function, enabling an attacker to execute arbitrary operating system commands without...

CVE-2026-104585

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection within the /download_data/ and /api/v1/scan endpoints. The flaw specifically affects the Dynamic Analyzer ADB integration module . This vulnerability allows for the execution of arbitrary commands on the underlying system...

CVE-2026-96951: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

Microsoft Windows: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-104585: Improper Neutralization of Special Elements used in a Command

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

PT-2026-111779

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $id i...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

PT-2026-113153

Name of the Vulnerable Software and Affected Versions Microsoft Windows Shell versions prior to October 13, 2026 Windows 10 affected versions not specified Windows 11 versions 23H2 through 26H2 Windows Server versions 2012 R2 through 2025 Description Improper neutralization of special elements us...

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-110236: Improper Neutralization of Special Elements used in an OS Command

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

PT-2026-111968

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /download data/, /api/v1/scan, Dynamic Analyzer ADB integration module...

Danfoss AK-SM800A Command Injection (CVE-2025-41451)

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command 'Command Injection' in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system. This plugin only works with Tenable.ot. Please...

CVE-2026-97781: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

CVE-2026-106171: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

PT-2026-113218

Name of the Vulnerable Software and Affected Versions Microsoft Office OneNote affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At...

PT-2026-112052

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-110233: Improper Neutralization of Special Elements used in an OS Command

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-104584

The reNgine tool (up to v2.2.0 and master branch commit de4199222cca5618f1255930ce78987e47d43a99 ) is vulnerable to OS Command Injection . The root cause lies in the custom_headers scan engine configuration field within web/reNgine/tasks.py, specifically in the fetch_url and dir_file_fuzz functio...

Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Overview Versions = 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execut...