188724 matches found
CVE-2026-104584: Undefined Security Weakness
reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...
Danfoss AK-SM800A Command Injection (CVE-2025-41451)
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command 'Command Injection' in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system. This plugin only works with Tenable.ot. Please...
CVE-2026-110205: Incomplete List of Disallowed Inputs
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...
CVE-2026-109108: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly an...
CVE-2026-109110: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was...
CVE-2026-109429: Interpretation Conflict
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...
PT-2026-111884
Name of the Vulnerable Software and Affected Versions Azure CycleCloud affected versions not specified Description Improper neutralization of special elements used in an OS command leads to an OS command injection. This allows an authorized attacker to execute code locally on the system...
Microsoft Windows: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-111777
Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....
PT-2026-113310
Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...
PT-2026-111781
Name of the Vulnerable Software and Affected Versions Fortinet FortiManager version 8.0.0 Fortinet FortiManager versions 7.6.0 through 7.6.6 Fortinet FortiManager Cloud versions 7.6.2 through 7.6.6 Description An OS command injection issue exists due to improper neutralization of special elements...
CVE-2026-104584
reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...
CVE-2026-110206: Interpretation Conflict
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...
CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...
CVE-2026-100207: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...
PT-2026-111181
Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...
MiracleLinux 9 : vim-8.2.2637-26.el9_8.23.ML.1 (AXSA:2026-2021:26)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2021:26 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directl...
MiracleLinux 8 : vim-8.0.1763-32.el8_10.ML.1 (AXSA:2026-2020:25)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2020:25 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directl...
