97214 matches found
PT-2026-89595
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...
PT-2026-89735
CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...
CVE-2026-78575: Improper Neutralization of Special Elements used in an OS Command
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...
CVE-2026-65639: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
CVE-2026-65638: Improper Neutralization of Special Elements used in an OS Command
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-64837: Improper Neutralization of Special Elements used in an OS Command
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...
PT-2026-89396
Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.7 Description A command injection issue exists in the gomod manager when processing unescaped depName parameters during import-path update commands while operating in binarySource=docker mode. This occurs durin...
PT-2026-89400
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...
...[ More ]
This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...
PT-2026-89468
Dell ThinOS 10, versions prior to 2605 10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...
PT-2026-89492
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-81550: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-19136: Improper Neutralization of Special Elements used in an OS Command
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...
CVE-2026-88282: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...
CVE-2026-88273: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...
PT-2026-89418
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...
CVE-2026-88885: Improper Neutralization of Special Elements used in an OS Command
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...
CVE-2026-79724: Improper Neutralization of Special Elements used in an OS Command
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...
PT-2026-89641
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary commands. This occurs due to improper neutralization of special elements used in an OS command, which...