CVE-2026-84278: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

CVE-2026-107703: Improper Neutralization of Special Elements used in an OS Command

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107704: Improper Neutralization of Special Elements used in an OS Command

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107510: Improper Neutralization of Argument Delimiters in a Command

An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation...

CVE-2026-105110: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...

CVE-2026-93699: Improper Neutralization of Argument Delimiters in a Command

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

PT-2026-107793

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection issue exists in maintenance command-line diagnostic utilities. The binary fails to sanitize user-supplied input...

PT-2026-108202

Name of the Vulnerable Software and Affected Versions Dromara Skyeye versions prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 Description A missing authentication issue exists in the bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false...

CVE-2026-107780: Improper Neutralization of Special Elements used in an OS Command

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...

PT-2026-108155

Name of the Vulnerable Software and Affected Versions @enmaso/node-convert versions prior to 1.0.1 Description An OS command injection issue exists in the convert.js file. Attackers can execute shell commands with Node.js process privileges by injecting shell metacharacters or a single quote into...

PT-2026-108156

Name of the Vulnerable Software and Affected Versions image optimizer Ruby gem versions 1.3.0 through 1.9.0 Description An OS command injection flaw exists in the identify format function. This occurs when the identify option is enabled, allowing attackers to execute arbitrary commands by providi...

PT-2026-108152

Name of the Vulnerable Software and Affected Versions ppt2png versions 0.0.1 through 0.0.6 Description An OS command injection flaw exists where attackers can execute operating system commands by providing unsanitized input or output path arguments. This occurs when shell metacharacters, such as ...

PT-2026-108189

Name of the Vulnerable Software and Affected Versions Tenable Identity Exposure SaaS affected versions not specified Description A command injection flaw exists in the Active Directory Events Listener. This allows an authenticated attacker with low privileges to execute arbitrary commands with...

PT-2026-107804

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection issue exists in the time and zone management subsystem. The system fails to sanitize input values when updating...

CVE-2026-87666: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Sudo vulnerability (USN-8895-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8895-1 advisory. It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with...

PT-2026-108160

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated high-privileged user can execute arbitrary commands with root privileges due to a command injection flaw in the SUID-root ssh config wrapper component. This occurs when...

CVE-2026-93858: Improper Neutralization of Special Elements used in an OS Command

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

PT-2026-108115

Name of the Vulnerable Software and Affected Versions OpenStack Mistral versions prior to 23.0.0 Description The std.ssh proxied action passes a caller-supplied proxy command value directly to the paramiko.ProxyCommand function before attempting an SSH connection to a gateway or target host. An...

CVE-2026-104078: Improper Neutralization of Input During Web Page Generation

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...