WS-2026-0132

mise 2026.7.11 before 2026.10.11: a mise.toml containing only tasks loads without trust; if one of its tasks sets file to a remote URL, mise tasks ls, mise tasks info and mise tasks validate fetch that file and render its MISE header templates, so a template such as exec... runs commands without ...

CVE-2026-104586

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the expansion of %u in the configuration when an untrusted username containing special characters such as '$' or a non-trailing backslash is passed on the ssh command line. An attacker can execute arbitrary shell...

CVE-2026-111322: Missing Authentication for Critical Function

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-96893)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

PT-2026-115109

Name of the Vulnerable Software and Affected Versions Tianji versions prior to 1.31.29 Description The formatString function in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to the lodash template function while the default evaluate pattern is enabled....

RHEL 8 : lrzsz (RHSA-2026:83525)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory. - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious...

PT-2026-114950

Name of the Vulnerable Software and Affected Versions AUTOM8N WHM/cPanel plugin versions prior to commit 82821f7 Description An OS Command Injection exists in the 'borg restore.cgi' endpoint. OS Command Injection is a flaw that allows an attacker to execute arbitrary operating system commands on...

PT-2026-114953

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE2-A versions prior to 2026-09-24-841a51c6d5 tclinux.bin Description An OS command injection flaw exists in the Login Processing component within the sub 12580 function of the api.cgi file. A remote attacker can exploit this b...

PT-2026-115280

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...

PT-2026-114993

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

PT-2026-114997

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 Description The OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view fail to apply quote-safe encoding to the common name of a client when...

PT-2026-115185

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces ppps edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submi...

PT-2026-115194

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services captiveportal hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected users with shel...

PT-2026-115190

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

PT-2026-115189

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes a...

PT-2026-115191

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

PT-2026-115182

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface...

PT-2026-114960

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...