CVE-2026-55562: Improper Neutralization of Input During Web Page Generation

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-77096: Missing Authentication for Critical Function

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-96893: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing...

PT-2026-111181

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.2.7 GitLab EE versions 19.3 through 19.3.4 GitLab EE versions 19.4 through 19.4.1 Description An issue exists where improper neutralization of special elements during the construction of AI conversation conte...

CVE-2026-97781: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...

PT-2026-112041

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check filter exec in mt.c passed the constructed command...

PT-2026-111824

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4 Description A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by...

PT-2026-111856

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opene...

CVE-2026-75826: Improper Neutralization of Special Elements used in an OS Command

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

MiracleLinux 9 : vim-8.2.2637-26.el9_8.23.ML.1 (AXSA:2026-2021:26)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2021:26 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directl...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791919907)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791919907 advisory. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and...

PT-2026-111296

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices, RUTOS 7.22 before 7.25.2 TAP devices, and TSWOS 1.9 before 1.10.4 TSW and SWM devices allows a remote authenticated...

PT-2026-113218

Name of the Vulnerable Software and Affected Versions Microsoft Office OneNote affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At...

Komodo Periphery agent contains an OS command injection vulnerability

Overview Versions = 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execut...

VulnCheck KEV: CVE-2026-96951

Improper neutralization of special elements used in a command 'command injection' in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-111777

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

PT-2026-112874

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...

South River Titan MFT Server 26.0.0 First-Run Command Injection

South River Titan MFT Server version 26.0.0 contains a first-run administrator setup exposure that permits an unauthenticated reachable client to create the initial administrator. The proof of concept uses the resulting access to configure a job post-transfer command that executes as the service...

PT-2026-111884

Name of the Vulnerable Software and Affected Versions Azure CycleCloud affected versions not specified Description Improper neutralization of special elements used in an OS command leads to an OS command injection. This allows an authorized attacker to execute code locally on the system...