AlmaLinux 8 : environment-modules (ALSA-2026:82919)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82919 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable ha...

Oracle Linux 8 : environment-modules (ELSA-2026-82919)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-82919 advisory. 4.5.2-5 - Fix command injection in bash Tab completion via compgen -W expansion CVE-2026-85013 Tenable has extracted the preceding description block directly...

CVE-2026-110908: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense FRR package pfSense-pkg-frr 2.0.21 and source revision 2.1.21 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression in...

PT-2026-114953

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE2-A versions prior to 2026-09-24-841a51c6d5 tclinux.bin Description An OS command injection flaw exists in the Login Processing component within the sub 12580 function of the api.cgi file. A remote attacker can exploit this b...

CVE-2026-104586

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the expansion of %u in the configuration when an untrusted username containing special characters such as '$' or a non-trailing backslash is passed on the ssh command line. An attacker can execute arbitrary shell...

CVE-2026-111215: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...

CVE-2026-45449: Improper Neutralization of Special Elements used in an OS Command

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory. - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious...

CVE-2026-110957: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

PT-2026-114950

Name of the Vulnerable Software and Affected Versions AUTOM8N WHM/cPanel plugin versions prior to commit 82821f7 Description An OS Command Injection exists in the 'borg restore.cgi' endpoint. OS Command Injection is a flaw that allows an attacker to execute arbitrary operating system commands on...

CVE-2026-104586: Undefined Security Weakness

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

PT-2026-115194

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services captiveportal hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected users with shel...

environment-modules security update

4.5.2-5 - Fix command injection in bash Tab completion via compgen -W expansion CVE-2026-85013...

PT-2026-115181

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

PT-2026-115190

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

UBUNTU-CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-47786: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

CVE-2026-34007: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...

CVE-2026-111214: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...