Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with...

Juniper Junos OS Vulnerability (JSA112180)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112180 advisory. - An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25111)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the restore route. This plugin only works with Tenable.ot. Please visit...

RHEL 8 : environment-modules (RHSA-2026:82919)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82919 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

PT-2026-113640

Name of the Vulnerable Software and Affected Versions SiteGuard Server Edition versions 2.20 through 8.00 Update 4 Apache httpd, Nginx, and IIS outside FreeBSD SiteGuard Server Edition versions 2.20 through 7.00 Update 5 Apache httpd and Nginx on FreeBSD Description SiteGuard Server Edition...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20910)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update update action to achieve remote code execution. This plug...

CVE-2026-46449

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-46449

The Akamai Guardicore Platform Agent (GPA) for macOS versions prior to 7.4 is vulnerable to a local privilege escalation via a command injection flaw in the wapptunneld component. The root cause is a lack of input validation when the service uses network interface names to execute system utilitie...

PT-2026-113595

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Samsung Open Source QA-Board allows : OS Command Injection...

simple-git 3.36.0 Command Execution

simple-git versions through version 3.36.0 contain a command execution issue that bypasses unsafe operation checks through abbreviated Git long options...

PT-2026-113756

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...

PT-2026-113780

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

PT-2026-113773

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

CVE-2026-0313: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-54702: Exposed Dangerous Method or Function

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-110650: Improper Neutralization of Special Elements used in an OS Command

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110647: Improper Neutralization of Special Elements used in an OS Command

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --doc...

CVE-2026-110644: Improper Neutralization of Special Elements used in an OS Command

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-16740: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239...