PT-2026-112041

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...

PT-2026-111830

Name of the Vulnerable Software and Affected Versions Roo Code versions prior to 3.54.1 Description A command approval bypass exists in the parseCommandLine function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By...

PT-2026-111824

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...

PT-2026-111302

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A version 251117 Description A remote OS command injection exists in the /cgi-bin/uploadVpn.cgi endpoint. The issue occurs when the Type variable is manipulated, affecting the popen function. OS command injection is a flaw...

PT-2026-111728

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.119 Description An issue exists in the administrator Activity Log within htdocs/js/pages/admin/Activity.js where the item.user.full name value is concatenated into HTML without proper encoding via encode entities...

VulnCheck KEV: CVE-2026-96951

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-113545

Name of the Vulnerable Software and Affected Versions Citrix UniconOS versions prior to 2607.2 CR Citrix UniconOS versions prior to 2603 LTSR CU2 Description An issue in Citrix UniconOS allows for persistent command execution. Recommendations Update Citrix UniconOS to version 2607.2 CR or later...

PT-2026-113153

Name of the Vulnerable Software and Affected Versions Microsoft Windows Shell versions prior to October 13, 2026 Windows 10 affected versions not specified Windows 11 versions 23H2 through 26H2 Windows Server versions 2012 R2 through 2025 Description Improper neutralization of special elements us...

PT-2026-111777

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

PT-2026-111569

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update config can inject an uppercase LOG FORMAT command localfile that the collector runs as root on...

PT-2026-111604

Name of the Vulnerable Software and Affected Versions CVFS affected versions not specified Description An input validation issue exists that allows for command execution. Recommendations Update CVFS to the resolved maintenance release...

PT-2026-111181

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...

PT-2026-111311

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN592AX6 version 250422 Description A flaw in the wmapd Daemon allows for remote OS command injection. The issue resides within the system function, enabling an attacker to execute arbitrary operating system commands without...

PT-2026-111781

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager version 8.0.0 Fortinet FortiManager versions 7.6.0 through 7.6.6 Fortinet FortiManager Cloud versions 7.6.2 through 7.6.6 Description An OS command injection issue exists due to improper neutralization of special elements...

PT-2026-111884

Name of the Vulnerable Software and Affected Versions Azure CycleCloud affected versions not specified Description Improper neutralization of special elements used in an OS command leads to an OS command injection. This allows an authorized attacker to execute code locally on the system...

CVE-2026-104585: Improper Neutralization of Special Elements used in a Command

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-104585

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection within the /download_data/ and /api/v1/scan endpoints. The flaw specifically affects the Dynamic Analyzer ADB integration module . This vulnerability allows for the execution of arbitrary commands on the underlying system...

CVE-2026-104584: Undefined Security Weakness

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

Microsoft Windows: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...