CVE-2026-106171: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

PT-2026-111604

Name of the Vulnerable Software and Affected Versions CVFS affected versions not specified Description An input validation issue exists that allows for command execution. Recommendations Update CVFS to the resolved maintenance release...

PT-2026-113218

Name of the Vulnerable Software and Affected Versions Microsoft Office OneNote affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At...

PT-2026-111181

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...

CVE-2026-104585

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection within the /download_data/ and /api/v1/scan endpoints. The flaw specifically affects the Dynamic Analyzer ADB integration module . This vulnerability allows for the execution of arbitrary commands on the underlying system...

PT-2026-112041

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...

PT-2026-111830

Name of the Vulnerable Software and Affected Versions Roo Code versions prior to 3.54.1 Description A command approval bypass exists in the parseCommandLine function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By...

PT-2026-111680

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigge...

PT-2026-111824

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...

PT-2026-111302

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A version 251117 Description A remote OS command injection exists in the /cgi-bin/uploadVpn.cgi endpoint. The issue occurs when the Type variable is manipulated, affecting the popen function. OS command injection is a flaw...

PT-2026-111728

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.119 Description An issue exists in the administrator Activity Log within htdocs/js/pages/admin/Activity.js where the item.user.full name value is concatenated into HTML without proper encoding via encode entities...

MiracleLinux 8 : vim-8.0.1763-32.el8_10.ML.1 (AXSA:2026-2020:25)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2020:25 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directl...

Microsoft Windows: CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-113310

Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...

CVE-2026-110005: Undefined Security Weakness

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-104585: Improper Neutralization of Special Elements used in a Command

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...