EUVD-2026-101427

An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response...

Moderate: Red Hat Security Advisory: environment-modules security update

An update for environment-modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Cortex XSOAR: OS Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. Work around: Customers who are unable to upgrade immediately can mitigate this issue by disablin...

PAN-OS: Authenticated Admin Command Injection Vulnerability

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security ris...

Command Injection

Overview xhtml2pdf is a PDF generator using HTML and CSS Affected versions of this package are vulnerable to Command Injection in the startViewer function in xhtml2pdf/pisa.py, whose fallback path interpolates the file name into a shell string as os.system'open "%s"' % filename after os.startfile...

CVE-2026-73539

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-110645

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110650

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110647

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --doc...

CVE-2026-110649

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

CVE-2026-110648

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through childprocess.execSync, so shell metacharacter...

CVE-2026-110646

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

CVE-2026-110639

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110643

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio. Attackers can inject $ or backtick substitution or a closing quote into the unescaped path passed to childprocess.exec ...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110640

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

DEBIAN-CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110641

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...