Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25111)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route. This plugin only works with Tenable.ot. Please visit...

Juniper Junos OS Vulnerability (JSA112180)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112180 advisory. - An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25195)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24452)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25037)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution. This...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20910)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to achieve remote code execution. This plug...

RHEL 8 : environment-modules (RHSA-2026:82919)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82919 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

CVE-2026-110641: Improper Neutralization of Special Elements used in an OS Command

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

PT-2026-114191

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description An OS command injection flaw exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. This issue occurs du...

CVE-2026-101215: Improper Neutralization of Special Elements used in an OS Command

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

VulnCheck KEV: CVE-2026-110447

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running...

CVE-2026-110643: Improper Neutralization of Special Elements used in an OS Command

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio. Attackers can inject $ or backtick substitution or a closing quote into the unescaped path passed to childprocess.exec ...

EUVD-2026-100804

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

VulnCheck KEV: CVE-2026-39949

Cacti ≤ 1.2.30 has an authenticated OS command injection flaw. Users with device and graph template creation privileges can put shell metacharacters in a device’s notes field. Cacti’s variable replacement engine inserts that field, unsanitized, into RRDtool command-line arguments through the...

PT-2026-114084

Name of the Vulnerable Software and Affected Versions xhtml2pdf versions prior to 0.2.19 Description An OS command injection issue exists in the pisa.startViewer function. This occurs when unescaped file names are interpolated into os.system, allowing attackers to execute arbitrary commands as th...

PT-2026-113762

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XSOAR affected versions not specified Palo Alto Networks Cortex XSIAM OS Query content pack affected versions not specified Description A command injection issue in the OS Query content pack allows an authenticated...

CVE-2026-0313: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25105)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into parameters of the Modbus command tool in the debug route. This plugin only works with Tenable.ot...

Linux Distros Unpatched Vulnerability : CVE-2026-108546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishin...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_80507)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680507 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...