PT-2026-108714

Name of the Vulnerable Software and Affected Versions PraisonAI Agents affected versions not specified Description The Subprocess Sandbox backend fails to enforce security policies defined in the SecurityPolicy data class. Although the strict method is intended to create a restrictive environment...

PT-2026-108160

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated high-privileged user can execute arbitrary commands with root privileges due to a command injection flaw in the SUID-root ssh config wrapper component. This occurs when...

CVE-2026-104078: Improper Neutralization of Input During Web Page Generation

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the...

CVE-2026-84278: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root sshconfigwrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges...

EulerOS 2.0 SP15 : perl-GD (EulerOS-SA-2026-4002)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle.x000D x00...

PT-2026-107814

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associat...

PT-2026-107820

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An authenticated user with permissions to perform configuration downloads using remote server profiles can execute arbitrary shell comman...

CVE-2026-87666: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

PT-2026-108155

Name of the Vulnerable Software and Affected Versions @enmaso/node-convert versions prior to 1.0.1 Description An OS command injection issue exists in the convert.js file. Attackers can execute shell commands with Node.js process privileges by injecting shell metacharacters or a single quote into...

PT-2026-108043

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description A filter bypass exists in the bundled MathJax 3.2.2 Safe component. An attacker can execute arbitrary code by embedding a crafted href value containing a TAB byte in the URL scheme. This...

CVE-2026-106126: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

CVE-2026-105110: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...

PT-2026-108142

Name of the Vulnerable Software and Affected Versions Amazon Agent Plugins for AWS databases-on-aws versions prior to 1.7.1 Description An incomplete list of disallowed inputs allows a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper. This...

CVE-2026-94579: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...

CVE-2026-107699: Improper Neutralization of Special Elements used in an OS Command

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

AlmaLinux 8 : vim (ALSA-2026:77359)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:77359 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fro...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_75768)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly from...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Sudo vulnerability (USN-8895-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8895-1 advisory. It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with...

CVE-2026-93699: Improper Neutralization of Argument Delimiters in a Command

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

PT-2026-107874

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter...