PT-2026-111103

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-108918: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The...

CVE-2026-108916: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

CVE-2026-108895: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...

CVE-2026-82096: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-110614

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The software uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the...

PT-2026-110607

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...

CVE-2026-108817: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.runshell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be...

PT-2026-110512

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be...

Agno command injection vulnerability

Versions 3.0.9 and earlier of Agno contain a command injection vulnerability. This vulnerability stems from improper handling of the “command” parameter in the agno.CodingTools.runshell function within the CodingTools component, potentially allowing remote execution of OS commands...

CVE-2026-103528: Improper Neutralization of Special Elements Used in a Template Engine

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

PT-2026-110857

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

CVE-2020-37279: Improper Neutralization of Special Elements used in an OS Command

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

PT-2026-110915

Name of the Vulnerable Software and Affected Versions easy-pdf-merge versions 0.1.0 through 0.2.6 Description An OS command injection flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the source paths, destination path, or the maxHeap option. This occurs...

CVE-2026-108894: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument...

environment-modules security update

5.6.1-2.1 - fix command injection in bash Tab completion CVE-2026-85013 RHEL-260562...

EulerOS 2.0 SP13 : containerd (EulerOS-SA-2026-4126)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4308)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

EulerOS 2.0 SP11 : dracut (EulerOS-SA-2026-4315)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options,...

EulerOS 2.0 SP11 : sg3_utils (EulerOS-SA-2026-4379)

According to the versions of the sg3utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing...