CVE-2026-111225: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111224: Improper Neutralization of Special Elements used in an OS Command

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes an...

CVE-2026-111216: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

CVE-2026-104586: Undefined Security Weakness

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

CVE-2026-45449: Improper Neutralization of Special Elements used in an OS Command

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-110957: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

CVE-2026-111218: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111214: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

CVE-2026-111226: Improper Neutralization of Special Elements used in an OS Command

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

CVE-2026-111229: Improper Neutralization of Special Elements used in an OS Command

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...

CVE-2026-110908: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense FRR package pfSense-pkg-frr 2.0.21 and source revision 2.1.21 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression in...

CVE-2026-34007: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...

Security Update for Microsoft Visual Studio Code (October 2026)

The remote host has an application installed that is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. CVE-2026-102235 - Improper...

AlmaLinux 9.2 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792080478)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792080478 advisory. - GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an...

PT-2026-115179

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the expansion of %u in the configuration when an untrusted username containing special characters such as '$' or a non-trailing backslash is passed on the ssh command line. An attacker can execute arbitrary shell...

AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory. - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious...

CVE-2026-104586

The AUTOM8N (WHM/cPanel plugin) is vulnerable to OS Command Injection and Arbitrary File Write in the borg_restore.cgi script, specifically in versions through commit 82821f7 . The root cause is the direct concatenation of unsanitized HTTP GET/POST form parameters into system commands executed vi...

CVE-2026-47786: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

UBUNTU-CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...