CVE-2025-70518: Improper Neutralization of Special Elements used in a Command

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2026-76437: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2025-70521

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a critical vulnerability in the management portal's diagnostic ping tool . Due to improper neutralization of special elements, the tool fails to handle user-supplied input securely. This allows an unauthenticated attacker to pe...

PT-2026-107525

Name of the Vulnerable Software and Affected Versions Fanvil x7a version 2.6.0.1182 Description The management portal diagnostic ping tool fails to securely handle user-supplied input. This allows an unauthenticated attacker to perform command injection and execute arbitrary code within the...

CVE-2025-70518

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a command injection vulnerability in the management portal's diagnostic ping tool . Due to insecure handling of user-supplied input, an unauthenticated attacker can inject commands to execute arbitrary code on the underlying An...

CVE-2026-107202: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...

CVE-2026-92531: Improper Neutralization of Special Elements used in an OS Command

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-106057: Improper Neutralization of Special Elements used in an OS Command

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106058: Improper Neutralization of Special Elements used in an OS Command

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

CVE-2026-106056: Improper Neutralization of Special Elements used in an OS Command

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-102256: Improper Neutralization of Special Elements used in an OS Command

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

CVE-2025-70521: Improper Neutralization of Special Elements used in a Command

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2026-106556: Improper Neutralization of Special Elements used in an OS Command

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

VulnCheck KEV: CVE-2026-29058

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration e.g., configuration...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

PT-2026-107478

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-20321: Missing Standardized Error Handling Mechanism

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

CVE-2026-93674: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-106059: Improper Neutralization of Special Elements used in an OS Command

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

PT-2026-107528

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2025-70521 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-10-07 A critical vulnerability Command Injection has been disclosed affecting Unknown. Patch...