Rocky Linux 8 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_80506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...

PT-2026-114088

Name of the Vulnerable Software and Affected Versions Beganovich snappdf versions 1.1.0 through 6.0.9 Description An OS command injection issue exists on Windows systems. Attackers can execute arbitrary commands as the PHP process by influencing the rendered URL. This occurs when cmd.exe...

PT-2026-114084

Name of the Vulnerable Software and Affected Versions xhtml2pdf versions prior to 0.2.19 Description An OS command injection issue exists in the pisa.startViewer function. This occurs when unescaped file names are interpolated into os.system, allowing attackers to execute arbitrary commands as th...

CVE-2026-110536: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been...

PT-2026-113872

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved affected versions not specified Description An OS Command Injection issue exists in the TACACS component. This allows a low-privileged user authenticated via TACACS+ to execute commands with root privileges,...

PT-2026-114191

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description An OS command injection flaw exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. This issue occurs du...

CVE-2026-106931: Improper Neutralization of Special Elements used in an OS Command

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-54525: Improper Neutralization of Special Elements used in an OS Command

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130073 advisory. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130082)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130082 advisory. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode...

CVE-2026-110637: Improper Neutralization of Special Elements used in an OS Command

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20902)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route. This plugin only work...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-21389)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route. This plugin only works with Tenable.ot. Please...

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

CVE-2026-110392: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Samsung Open Source QA-Board allows : OS Command Injection...

Rocky Linux 10.2 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_80664)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

RHEL 8 : environment-modules (RHSA-2026:82919)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82919 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

CVE-2026-105429: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

CVE-2026-73792: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow...

CVE-2026-101216: Improper Neutralization of Special Elements used in a Command

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...