SUSE CVE-2026-25706

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

PT-2026-84471

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated low-privileged user can execute arbitrary commands as a privileged user on the underlying operating system through affected command-line...

CVE-2026-59680: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

PT-2026-84297

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An authenticated user with limited privileges can exploit a command injection flaw to execute arbitrary commands with root privileges. Command injection is a security issue where an...

Alibaba Cloud Linux 3 : 0273: sg3_utils (ALINUX3-SA-2026:0273)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0273 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-16313: A flaw was found in sg3utils. The...

CVE-2026-73770: External Control of File Name or Path

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute...

CVE-2026-73768: Improper Input Validation

A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...

CVE-2026-73767: Improper Neutralization of Special Elements used in an OS Command

Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73763: Improper Neutralization of Special Elements used in a Command

A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility...

CVE-2026-73751: Improper Neutralization of Special Elements used in a Command

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

PT-2026-89939

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

PT-2026-84143

Name of the Vulnerable Software and Affected Versions OpenNebula versions prior to 7.4 Description Incorrect access control allows an authenticated user with basic permissions to execute commands on virtual machines belonging to other users. This occurs via the one.vm.exec function due to a lack ...

PT-2026-84481

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A flaw in a management component allows an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation enables remote command...

PT-2026-84409

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write flaw exists in the API of HPE Networking Fabric Composer. This issue allows an authenticated user with low privilege operator permissions to...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

PT-2026-84486

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A flaw in the command line interface allows for the improper processing of malformed input, which could enable an attacker to execute arbitrary commands with root privileges. Recommendations A...

PT-2026-84413

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacke...

CVE-2026-76658: Improper Authentication

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-25706: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

PT-2026-84423

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write issue exists in the API of the software, which could allow an authenticated administrative user to escalate privileges. Successful exploitation...