PT-2026-78383

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf and movePathTo functions located in app/src/util/pathName.ts used by the 'move/link to' path-selection dialogs...

Linux Distros Unpatched Vulnerability : CVE-2026-75926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the...

PT-2026-78433

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for VMs versions 6.0.3 through 6.0.3.1 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A high privileged attacker with remote access could exploit th...

PT-2026-78691

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description An authenticated user can execute arbitrary commands on the source SSH host with the privileges of the connected SSH account. The issue occurs when the application interpolates endpointPort, sourcePor...

PT-2026-78358

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. A low privileged attacker with remote access can exploit this flaw t...

PT-2026-78831

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.2.1 Description Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management componen...

MONAI vulnerable to OS command injection

Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...

EUVD-2026-61212

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-63641

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

CVE-2026-71551

The EXEC IPC handler in electron/ipc-handlers/exec.ts passes arbitrary commands via child_process.exec() without requiring nodeExecution permission. Community plugins run with new Function() can call window.ea.exec() to execute OS commands under the desktop account's privileges. The confirmation ...

CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-71551 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-63641 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

CVE-2026-70415

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service...

EUVD-2026-61058

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service...

CVE-2026-70415

Dell PowerStore SDNAS has a buffer-copy flaw in its NFS/RPC stack, exploitable by an unauthenticated remote attacker to achieve command execution and DoS. CVSS 3.1 scores it HIGH (8.1). Dell advisory DSA-2026-330 covers the fix; no in-the-wild exploitation is reported. Apply Dell's security updat...

CVE-2026-75926

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-75926

Hugo 0.162.0–0.164.x added tailwindcss to the default security.exec.allow list, causing nodePermissionArgs to append --allow-child-process. A malicious tailwind.config.js executes top-level code inside the permitted Node process, calls child_process to spawn a shell, and the spawned non-Node proc...

CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...