CVE-2026-108072

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...

CVE-2026-73792

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow...

CVE-2026-73792

A security vulnerability exists in HPE NonStop Java JToolkit (T2716) that could allow command injection and buffer overflow . Affected versions include T2716L11^ABS and earlier. The vulnerability has a CVSS 3.1 base score of 3.8, with a local attack vector and high complexity. HPE has released a ...

CVE-2026-73792 HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow...

CVE-2026-73792 HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow...

EUVD-2026-100947

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow...

SiteGuard Server Edition vulnerable to OS command injection

Overview SiteGuard Server Edition provided by EG Secure Solutions Inc. is a host-based Web Application Firewall WAF designed to be integrated into a web server. The statistics feature of SiteGuard Server Edition contains the following vulnerability: OS command injection CWE-78 - CVE-2026-106931...

CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CURL-CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

DEBIAN-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

EUVD-2026-100897

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CVE-2026-105106

The Koha library is vulnerable to OS command injection within the Task Scheduler deletion path. The tools/scheduler.pl handler accepts a jobid parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without proper validation. Specifically, Schedule::At::remove substitutes the un...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control VulnerabilityAn improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-21998 DESCRIPTION: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8...