PT-2026-113769

🚨 CVE-2026-0320 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface...

CVE-2026-86002: Improper Neutralization of Directives in Dynamically Evaluated Code

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-110645: Improper Neutralization of Special Elements used in an OS Command

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

PT-2026-114022

Insertion of sensitive information into log files in the git utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because...

PT-2026-114085

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio. Attackers can inject $ or backtick substitution or a closing quote into the unescaped path passed to child process.exec...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130082)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130082 advisory. An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25721)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the server username and/or password fields of the restore action in the API V1 route. This plugin...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_80507)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680507 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...

Linux Distros Unpatched Vulnerability : CVE-2026-108976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an incomplete list of disallowed inputs...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25196)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the Wi- Fi SSID and/or password fields can lead to remote code execution when the configuration is...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-3037)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed duri...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24695)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into OpenSSL argument fields within requests sent to the utility route, leading to remote code executio...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24452)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted template file to the devices route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25037)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by configuring a maliciously crafted LCD state which is later processed during system setup, enabling remote code execution. This...

PT-2026-114160

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description A signature bypass exists in the 'waiting-webhook' endpoint. The issue occurs because the system selects Send-and-Wait validation before normalizing an alternate node...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

PT-2026-113595

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Samsung Open Source QA-Board allows : OS Command Injection...

PT-2026-114191

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description An OS command injection flaw exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. This issue occurs du...

CVE-2026-105106: Improper Neutralization of Special Elements used in an OS Command

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

PT-2026-114218

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.6 Description The pre-installation endpoint "web/instalador/instalador.php" is accessible before the config.php file is created and processes unauthenticated POST data. During the Linux reinstall process, a speciall...