EUVD-2026-98213

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...

CVE-2026-96893

GitLab EE is vulnerable to Improper Neutralization of Input Used for LLM Prompting (CWE-1427) in the GitLab Duo Agent Platform . This flaw allows an authenticated user to inject specially crafted content into AI agent instructions due to improper neutralization of special elements during AI conve...

CVE-2026-96893 Improper Neutralization of Input Used for LLM Prompting in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...

EUVD-2026-98069

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-98068

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116

The Yeoman-UI / Application Wizard Extension for VS Code is vulnerable to OS Command Injection (CWE-78). The issue stems from the use of child_process.execSync with a shell string during generator installation and uninstallation. Specifically, the ApplicationWizard.installationLocation workspace ...

EUVD-2026-98196

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-110205: Incomplete List of Disallowed Inputs

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...

CVE-2026-110206: Interpretation Conflict

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...

CVE-2026-55376: Improper Neutralization of Special Elements used in an OS Command

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-109108: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly an...

CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...

CVE-2026-104584

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

CVE-2026-109429: Interpretation Conflict

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

Debian dla-4832 : nagios4 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4832 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4832-1 [email protected]...

CVE-2026-104584

The reNgine tool (up to v2.2.0 and master branch commit de4199222cca5618f1255930ce78987e47d43a99 ) is vulnerable to OS Command Injection . The root cause lies in the custom_headers scan engine configuration field within web/reNgine/tasks.py, specifically in the fetch_url and dir_file_fuzz functio...

Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Overview Versions = 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execut...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791919907)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791919907 advisory. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and...