CVE-2026-82098: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2025-002801)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002801 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a...

PT-2026-89399

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation...

CVE-2026-82099: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-73694: Improper Neutralization of Special Elements used in an OS Command

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

CVE-2026-81467: Improper Neutralization of Special Elements used in an OS Command

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-88276: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root...

CVE-2026-88272: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

PT-2026-89313

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

PT-2026-89314

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

PT-2026-89323

🚨 HIGH: CVE-2026-88282 CVSS 7.2 GeoVision GV-LPC2211 V1.13 vulnerable to command injection via FTP username with shell metacharacters. Admin-level exploit leads to arbitrary root command execution. CVE Vulnerability PatchNow https://t.co/IQAFupHc3X...

PT-2026-89463

Dell ThinOS 10, versions prior to 2605 10.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89486

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description A remote, authenticated user with the accessCp permission can execute operating system commands with the privileges of the PHP web worker via the Control Panel. Recommendations At the momen...

PT-2026-89642

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89633

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary code. This occurs due to improper neutralization of special elements used in an OS command, which allow...

PT-2026-89316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration is applied...

PT-2026-89497

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...

PT-2026-89617

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An unauthenticated remote attacker can execute arbitrary OS commands on a Langflow instance by sending a crafted HTTP request. This occurs because the application fails to properly...

PT-2026-89496

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...