CVE-2026-54501: Improper Input Validation

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109820)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109820 advisory. Mitgation ofCVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be bypassed for certain browser types the webbrowser.open API could have...

PT-2026-95172

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description Microsoft 365 Copilot's Business Chat contains a command injection flaw, which occurs when special elements used in a command are not properly neutralized. This allows an...

PT-2026-95165

Name of the Vulnerable Software and Affected Versions Microsoft Copilot affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclose information over a network. Command injection ...

PT-2026-94159

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.11 NeuVector versions prior to 5.5.4 NeuVector versions prior to 5.6.2 Description Improper parameter handling in the packet capture mechanism allows an authenticated user with namespaced Runtime Policies write...

PT-2026-95091

Name of the Vulnerable Software and Affected Versions Browsertrix versions 1.15.0 through 1.22.7 Description Improper sanitization of Git URLs specified as Custom Behaviors allows command injection via the '/api/orgs//crawlconfigs/validate/custom-behavior' endpoint. A user with crawler or...

CVE-2026-85885: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

p5-GD -- OS command injection

GD project reports: Fix CVE-2026-11526, command injection via 2-arg open in makefilehandle. CWE-78, CWE-73 Reported and fixed by Paul Johnson...

CVE-2026-93337: Improper Neutralization of Argument Delimiters in a Command

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-3796)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-3821)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a...

EulerOS 2.0 SP15 : dracut (EulerOS-SA-2026-3802)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

Dokploy is vulnerable to OS command injection

Overview Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, are vulnerable to OS command injection during the backup creation and restoration processes. The vulnerability stems from unsanitized shell command construction that can allow an attacker to escalate...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string "sshpass -p 'password' rsync ..." with a plain strreplace and no escaping, so a single quote ...

CVE-2026-20350

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

CVE-2026-20283

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-20325

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...