PT-2026-114298

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER ARGS a...

PT-2026-113830

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved on PTX Series affected versions not specified Description An OS Command Injection issue exists in the bootzd zero-touch provisioning daemon. An unauthenticated attacker located on the management LAN can execut...

CVE-2026-110641: Improper Neutralization of Special Elements used in an OS Command

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

PT-2026-114084

Name of the Vulnerable Software and Affected Versions xhtml2pdf versions prior to 0.2.19 Description An OS command injection issue exists in the pisa.startViewer function. This occurs when unescaped file names are interpolated into os.system, allowing attackers to execute arbitrary commands as th...

PT-2026-114079

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child process.exec. Attackers can craft a book project with a malicious front-matter filename or project...

PT-2026-114082

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110648: Improper Neutralization of Special Elements used in an OS Command

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through childprocess.execSync, so shell metacharacter...

PT-2026-114090

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child process.execSync, so shell metacharacte...

Linux Distros Unpatched Vulnerability : CVE-2026-110236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names...

CVE-2026-54525: Improper Neutralization of Special Elements used in an OS Command

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...

CVE-2026-53563

Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-53563 Persistent Command Execution

Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-53563

A vulnerability in Citrix UniconOS (formerly eLux) allows for Persistent Command Execution . The root cause is identified as CWE-732: Incorrect Permission Assignment for Critical Resource . To exploit this, an attacker must have authenticated, low-privileged local access to the target system. Aff...

CVE-2026-86022

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

CVE-2026-55601

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-110005

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-104585

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-103848

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-103848 Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...