LG Simple Editor <= v3.21.0 - Command Injection

LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within t...

DrayTek Vigor - Command Injection

DrayTek Gateway devices Vigor2960, Vigor300B, etc. are vulnerable to command injection via the session parameter in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint. An attacker can inject arbitrary commands and retrieve their output. id: CVE-2024-12987 info: name: DrayTek Vigor - Command...

CVE-2026-102608: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102607: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...

CVE-2026-92263: Improper Neutralization of Special Elements used in an OS Command

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92115: Improper Neutralization of Special Elements used in a Command

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the value parameter of the update-photo AJAX action. This is due to insufficient shell escaping within the wppaimagemagicka function, where the...

CVE-2026-111451: Improper Neutralization of Special Elements used in an OS Command

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

MiracleLinux 8 : environment-modules-4.5.2-5.el8_10 (AXSA:2026-2078:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2078:01 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenab...

PT-2026-118624

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description In POSIX xonsh activation, the quote function uses repr to write non-ASCII prompt or destination data into the UTF-8 activate.xsh script. When xonsh reads this script using $XONSH ENCODING under...

PT-2026-115520

Name of the Vulnerable Software and Affected Versions The Grid versions prior to 2.8.2 Description Improper control of code generation allows for command injection, leading to remote code execution. This occurs when the software fails to properly sanitize input used in the generation of code...

CVE-2026-30971: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-108743: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache...

PT-2026-116147

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4.0.4 through 5.0.4 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. This primarily impacts services directly exposed to the public network, while...

VulnCheck KEV: CVE-2026-94169

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

PT-2026-115844

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are...

PT-2026-116143

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.3 Description The exportEvents function fails to neutralize shell metacharacters when processing the exportFile request parameter. An authenticated user with View Events or View Snapshots permissions can explo...

MiracleLinux 8 : emacs-26.1-15.el8_10.2 (AXSA:2026-2066:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2066:02 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the...

Rocky Linux 8 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_82919)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682919 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable has...

CVE-2026-94169: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1...

SUSE CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...