CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

PT-2026-96189

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.21.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0 Description ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated...

PT-2026-96079

Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.31.0 through 1.31.2 Description The Worker Service in Temporal Server includes a Worker Controller Instance module that registers a compute provider named subprocess. This provider allows the execution of commands on...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

VulnCheck KEV: CVE-2026-7273

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

PT-2026-96232

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2 Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

SUSE SLES12 Security Update : emacs (SUSE-SU-2026:3993-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3993-1 advisory. - code execution upon opening arbitrary file bsc1275941. - CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader bsc1276264....

MariaDB wsrep_notify_cmd Command Execution

The vulnerability of the wsrepnotifyCmd function in the MariaDB database management system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK A3300R Router Command Execution

The vulnerability of the setSmartQosCfg function in TOTOLINK A3300R router microprogramming systems is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

MariaDB SST Command Execution

The vulnerability of the State Snapshot Transfer SST mechanism of the MariaDB database management system is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-96300

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user with AI feature access can execute dangerous statements or database functions because the runQuery function in server/modules/ai/orchestrator/tools/runQuery.js uses an...

ROS-20260921-73-0073

The vulnerability in the incus is related to the insertion or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

PT-2026-104829

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to scan.lua and scripts/lua/rest/v2/exec/host/schedule vulnerability scan.lua accept the scan ports parameter without an administrator gate and pass it...

CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

EulerOS Virtualization 2.10.1 : vim (EulerOS-SA-2026-3858)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim...

RHEL 10 : sg3_utils (RHSA-2026:69124)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69124 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

FortiSandbox Threat Detection Data Cleaning Unauthorized Access Command Execution

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information or execu...

Incus uploadDir S3 Arbitrary Command Execution

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...