CVE-2026-102079: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended...

PT-2026-114081

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

PT-2026-113819

🚨 CVE-2026-101967 An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response. 🎖@cveNotify...

PT-2026-114086

Name of the Vulnerable Software and Affected Versions nodejs-whisper versions prior to 0.3.2 Description An OS command injection issue exists in the convertToWavType function. This occurs when crafted audio file paths containing closing quotes or $ command substitution are supplied. These inputs...

PT-2026-114190

Name of the Vulnerable Software and Affected Versions TR7 ASP versions 1.0.40.236 through 1.0.1554.2330 TR7 ASP versions 1.6.42.239 through 1.6.1554.2330 Description Missing authentication for a critical function in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances allows for...

PT-2026-114089

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --doc...

Shell command bypass Windows

The vulnerability of the Shell command shell in Windows operating systems is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to bypass existing security mechanisms...

PT-2026-114092

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate thumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate thumbnail, such as an uploaded file, can...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator t...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20764)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by providing malicious input via the device hostname configuration which is later processed during system setup, resulting in remote...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-24517)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into requests sent to the firmware update route. This plugin only works with Tenable.ot. Please visit...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25109)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route, leading to remote code execution. This plugi...

Adobe Experience Manager 2026.0.0 < 2026.9.28386 Multiple Vulnerabilities (APSB26-152)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.9.28386. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-152 advisory. - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20902)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route. This plugin only work...

Rocky Linux 10.2 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_80664)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

ModelScope MS-Agent 1.5.1 < 1.6.0 Command Injection (CVE-2026-2256)

The version of ModelScope MS-Agent installed on the remote host is 1.5.1 or later but prior to 1.6.0. It is, therefore, affected by a command injection vulnerability. The Shell tool runs commands on the host through a shell, guarded only by a regex denylist that can be bypassed, allowing an...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-23702)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfiguration action in the API V1 route. This...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25195)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by supplying a crafted firmware update file via the firmware update route. This plugin only works with Tenable.ot. Please visit...

CVE-2026-102059: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the phone-home daemon phcd of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary...

CVE-2026-110640: Improper Neutralization of Special Elements used in an OS Command

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...