PT-2026-116155

🚨 CVE-2026-108576 A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was...

CVE-2026-86022: Improper Neutralization of Special Elements used in an OS Command

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

CVE-2026-55601: Improper Neutralization of Special Elements used in an OS Command

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-69370: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-89116: Improper Neutralization of Special Elements used in an OS Command

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

SPIP odt2spip command injection vulnerability

Versions of SPIP prior to 4.4.0 have a command injection vulnerability. This vulnerability stems from improper cleaning of file names uploaded through the document import form. Authorized users can embed shell metacharacters such as $id in non-ODT file names. This allows for the execution of OS...

PT-2026-111525

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...

CVE-2026-77099: Improper Neutralization of Special Elements used in an OS Command

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

PT-2026-113290

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-109429: Interpretation Conflict

Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...

Debian dla-4832 : nagios4 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4832 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4832-1 [email protected]...

arbitrary command execution in fgfmsd daemon

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation...

Maian Guardian 2.1 License Generator Command Injection

Maian Guardian version 2.1 contains an authenticated command injection vulnerability in its license-generation routine. The supplied proof of concept authenticates to the administrator interface, submits an injected project identifier, and retrieves a target-side execution marker...

PT-2026-111828

Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...

PT-2026-111603

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-103848: Improper Neutralization of Special Elements used in an OS Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-96951: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-104585: Improper Neutralization of Special Elements used in a Command

Mobile Security Framework MobSF v4.5.2 is vulnerable to Command Injection in /downloaddata/, /api/v1/scan, Dynamic Analyzer ADB integration module...

CVE-2026-110005: Undefined Security Weakness

The periphery agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with Execute, or Read plus Logs, permission on a managed server can supply shell metacharacters in a container name processed by th...

CVE-2026-53563: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...