CVE-2026-77931 MoviePilot 3.1.5 Command Injection via ExecuteCommandTool

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the...

EUVD-2026-101806

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the...

CVE-2026-77931 MoviePilot 3.1.5 Command Injection via ExecuteCommandTool

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the...

CVE-2026-77931

MoviePilot through version 3.1.5 is vulnerable to a command injection vulnerability. The root cause lies in the ExecuteCommandTool , which uses asyncio.create_subprocess_shell to execute commands without sufficient restriction. Attackers can embed malicious instructions in untrusted content proce...

CLEANSTART-2026-ML37851 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...

EUVD-2026-101729

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

PT-2026-114432

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse webpage, search web, and torrent metadata parsers, which then get passed to the...

PT-2026-114440

Name of the Vulnerable Software and Affected Versions Netgate pfSense FRR package pfSense-pkg-frr versions 2.0.2 1 and 2.1.2 1 Description An authenticated WebGUI user with page-status-frr privileges can perform OS command injection through the FRR status filter. The issue occurs when a filter...

CVE-2026-104586

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

CVE-2026-104586

The AUTOM8N (WHM/cPanel plugin) is vulnerable to OS Command Injection and Arbitrary File Write in the borg_restore.cgi script, specifically in versions through commit 82821f7 . The root cause is the direct concatenation of unsanitized HTTP GET/POST form parameters into system commands executed vi...

PT-2026-114905

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution...

PT-2026-114931

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, grid obj open in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitra...

PT-2026-114886

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Statio...

EUVD-2026-102131

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

Koha Library Software OS Command Injection

Koha Library Software versions before 23.05.10 contain an OS command injection in cover-image ZIP processing. The proof of concept demonstrates command execution through a crafted uploaded ZIP filename. https://packetstorm.news/download/235863...

MaxKB 2.10.3-lts Prompt Injection Command Execution

MaxKB version 2.10.3-lts and earlier exposes an ungated shell execute tool to capable agents, allowing prompt injection through chat or ingested documents to trigger command execution. The included proof of concept demonstrates the missing approval gate and a sandbox-wrapper metacharacter escape...

...[ More ]

Vesta Control Panel VestaCP versions up to and including 0.9.8-26 contain an OS command injection vulnerability in the configuration parsing functionality. The shared shell library uses unsafe eval operations to process user-controlled configuration values, allowing an authenticated hosting accou...

environment-modules security update

4.5.2-5 - Fix command injection in bash Tab completion via compgen -W expansion CVE-2026-85013...

CVE-2026-111229: Improper Neutralization of Special Elements used in an OS Command

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...