CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032 navi through 2.24.0 OS Command Injection via Cheatsheet Variables

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges...

CVE-2026-101032

The navi tool (versions through 2.24.0 ) is vulnerable to OS Command Injection due to a failure to properly escape cheatsheet variable values during shell command substitution. An attacker can achieve arbitrary command execution with victim privileges by injecting shell metacharacters through cra...

segmented-pentest-lab

Segmented Pentest Lab A self-built, Docker-based segmented ne...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the process.run function during Liquidsoap configuration generation for live recording. An attacker can execute arbitrary system commands by supplying a specially crafted streamer username containing shell...

CVE-2026-100852

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100852

AzuraCast versions through 0.23.x are vulnerable to a command injection vulnerability within the Liquidsoap config generation for live recording. The root cause is the failure to properly quote the streamer username in process.run calls. Authenticated station users possessing Streamers and Profil...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

EUVD-2026-87836

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

EUVD-2026-87844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844

MONAI versions prior to 1.6.0 are vulnerable to an OS command injection flaw within the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). The root cause is the insecure concatenation of user-controlled values from YAML configuration files (specifically dataset_name_or_id) and CLI/kwar...

PT-2026-99547

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description An OS command injection flaw exists in the Web Management Interface component. A remote attacker can exploit this by manipulating the QUERY STRING argument passed to the eval function with...