CVE-2026-16848: Improper Neutralization of Special Elements used in an OS Command

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...

ROS-20260819-73-0013

The vulnerability in Mariadb 11.4 is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-75984: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used...

PT-2026-80671

Stata Command Injection via Unsanitized package in ado package install Summary The ado package install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent...

CVE-2026-65611: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

PT-2026-78727

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Description A user without admin or power roles can trick another user...

CVE-2024-58376: Improper Neutralization of Special Elements used in an OS Command

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2026-76231: Improper Neutralization of Special Elements used in a Command

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

PT-2026-78415

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-75616: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the AboutController process when the snmpget configuration parameter is manipulated to point to ...

CVE-2026-55426

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-53455

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-55426

The shell_exec() function in linuxfabrik-lib splits command strings on pipe characters, enabling command injection via attacker-controlled arguments (e.g., --repo '|touch /root/nagios-was-here|') in plugins like restic-check. If a plugin is in the sudoers file, a compromised nagios/icinga account...

CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

EUVD-2026-61493

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455

CVE-2026-53455 is a command injection vulnerability in Blueprint Studio , a VS Code-like editor for Home Assistant configuration files. Prior to version 2.5.2 , the component custom_components/blueprint_studio/backend/git_manager.py generated a shell-based Git credential helper by interpolating t...