CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-84502: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

PT-2026-97551

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...

PT-2026-97578

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description An unauthenticated remote attacker can provide specially crafted input that is incorporated into OS commands, leading to arbitrary command execution on the underlying system. Successful...

PT-2026-97357

Name of the Vulnerable Software and Affected Versions web.py version 0.76 Description Server-side template injection SSTI occurs when the template engine is tricked into executing attacker-controlled template code, bypassing built-in security checks. This happens when an application precompiles...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

PT-2026-97595

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

TencentOS Server 4: environment-modules (TSSA-2026:1035)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1035 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

EUVD-2026-85403

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

PT-2026-97543

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description An input-validation flaw exists in the sanitize jinja function. The function employs two regular expressions to reject user-supplied Jinja, but these patterns stop at the first...

CVE-2026-93349: Improper Neutralization of Special Elements used in an OS Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

Linux Distros Unpatched Vulnerability : CVE-2026-93012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...