CVE-2025-70521

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

PT-2026-107701

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description Users with the run collect capability can use the collect...

PT-2026-107593

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...

CVE-2026-106059: Improper Neutralization of Special Elements used in an OS Command

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

PT-2026-107484

Name of the Vulnerable Software and Affected Versions GitAhead versions prior to 2.7.2 Description On macOS, a command injection issue exists where repository filenames are interpolated without proper escaping into the Show in Finder AppleScript. An attacker can commit a file with a path containi...

CVE-2026-106056: Improper Neutralization of Special Elements used in an OS Command

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106058: Improper Neutralization of Special Elements used in an OS Command

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

EUVD-2025-211049

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2025-70518

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a command injection vulnerability in the management portal's diagnostic ping tool . Due to insecure handling of user-supplied input, an unauthenticated attacker can inject commands to execute arbitrary code on the underlying An...

CVE-2026-107202: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...

CVE-2025-70518

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2026-76279: Improper Input Validation

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to write events to internal indexes outside the index access configured for the role. The vulnerability is...

CVE-2025-70518: Improper Neutralization of Special Elements used in a Command

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...

CVE-2026-102256: Improper Neutralization of Special Elements used in an OS Command

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

CVE-2025-70521

The Fanvil x7a device, running firmware version 2.6.0.1182 , contains a critical vulnerability in the management portal's diagnostic ping tool . Due to improper neutralization of special elements, the tool fails to handle user-supplied input securely. This allows an unauthenticated attacker to pe...

PT-2026-107478

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

AlmaLinux 9 : vim (ALSA-2026:75768)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fro...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

Linux Distros Unpatched Vulnerability : CVE-2026-105841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : sg3_utils vulnerability (USN-8874-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8874-1 advisory. Shaomin Chen discovered that sg3utils did not properly sanitize device identification data...