EUVD-2026-100603

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-104085: Improper Neutralization of Special Elements used in an OS Command

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $id i...

CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-106171: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets...

CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

PT-2026-111395

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize the...

PT-2026-112874

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

PT-2026-111393

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize input...

CVE-2026-110236: Improper Neutralization of Special Elements used in an OS Command

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

Microsoft Windows: CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

Microsoft VS Code: CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-96951: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-11732: Improper Input Validation

An insufficient input validation vulnerability in the website blocking feature Block Sites of the listed NETGEAR router models allows a network-adjacent attacker having network access such as WiFi credentials to run unauthorized commands on the router. This vulnerability could affect the...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791919907)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791919907 advisory. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and...

CVE-2026-55562: Improper Neutralization of Input During Web Page Generation

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

PT-2026-111680

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigge...