EUVD-2026-100523

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

CVE-2026-55601 MultiTail: Shell injection in execute-on-match command handling

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-55601

The log monitoring utility MultiTail (version 7.1.5 and earlier ) is vulnerable to a shell injection flaw within its -ex and -eX execute-on-match features. The root cause lies in the check_filter_exec() function in mt.c, which passes a constructed command—containing unsafely escaped attacker-cont...

EUVD-2026-100521

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-55601

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

EUVD-2026-100460

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

CVE-2026-97781

A command injection vulnerability exists in Microsoft Office OneNote due to the improper neutralization of special elements used in a command. This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated with a High severity (CVSS 8.8) and ...

EUVD-2026-100318

Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...

CVE-2026-100207

A vulnerability in Azure CycleCloud involving improper neutralization of special elements used in an OS command (OS command injection) allows an authorized attacker to execute code locally . This flaw is associated with CWE-78 and has a CVSS 3.1 base score of 7.3 . While the vulnerability was ide...

EUVD-2026-100274

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-96951

The Windows Shell is vulnerable to a security feature bypass (CVE-2026-96951) caused by improper neutralization of special elements used in a command (command injection). This flaw affects Windows 10 , Windows 11 , and certain Server versions , and was also identified in Outlook.com cloud service...

EUVD-2026-99289

Improper neutralization of special elements used in a command 'command injection' in Windows Update allows an authorized attacker to elevate privileges locally...

CVE-2026-69718

A command injection vulnerability exists in Windows Update due to the improper neutralization of special elements used in a command. This flaw allows an authorized attacker to achieve local privilege escalation . No specific exploit information or code is provided in the documents. Remediation in...

CVE-2026-69370

Visual Studio Code is vulnerable to a command injection flaw due to the improper neutralization of special elements used in a command. This vulnerability allows an unauthorized attacker to achieve remote code execution over a network. While the impact is high, specific details regarding the vulne...

EUVD-2026-99068

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-110237

Versions 0.8.1-beta through 0.14.4 of Vifm are vulnerable to a local privilege escalation flaw. The software reuses a pre-existing IPC FIFO in the shared temporary directory without verifying its ownership. A local attacker can pre-create a world-writable vifm-ipc-vifm FIFO and inject IPC packets...

EUVD-2026-99021

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...