CVE-2026-110205: Incomplete List of Disallowed Inputs

Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...

PT-2026-111393

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize input...

CVE-2026-104584

reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791919907)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791919907 advisory. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and...

Microsoft VS Code: CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-109409: Improper Neutralization of Special Elements used in a Command

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

PT-2026-112052

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

PT-2026-113153

Name of the Vulnerable Software and Affected Versions Microsoft Windows Shell versions prior to October 13, 2026 Windows 10 affected versions not specified Windows 11 versions 23H2 through 26H2 Windows Server versions 2012 R2 through 2025 Description Improper neutralization of special elements us...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

PT-2026-113310

Name of the Vulnerable Software and Affected Versions Komodo version 2.2.0 Description The periphery agent's container-management functionality allows an authenticated low-privileged user with Execute or Read and Logs permissions to perform OS command injection. By supplying shell metacharacters ...

Microsoft Windows: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-111181

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...

CVE-2026-55562: Improper Neutralization of Input During Web Page Generation

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

Siemens WinCC

SUMMARY Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and...

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-111728

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.119 Description An issue exists in the administrator Activity Log within htdocs/js/pages/admin/Activity.js where the item.user.full name value is concatenated into HTML without proper encoding via encode entities...

Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Overview Versions = 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execut...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

CVE-2026-19938

The Bluetooth host stack is vulnerable to a use-after-free and memory corruption in the ATT transmit path. Specifically, in subsys/bluetooth/host/att.c, the BT_ATT_OP_SIGNED_WRITE_CMD branch incorrectly calls net_buf_unref(buf) when bt_smp_sign() fails. This violates the established contract wher...