PT-2026-108202

Name of the Vulnerable Software and Affected Versions Dromara Skyeye versions prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 Description A missing authentication issue exists in the bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false...

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled...

CVE-2026-87675: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...

EulerOS 2.0 SP15 : perl-GD (EulerOS-SA-2026-3936)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle.x000D x00...

RockyLinux 8 : vim (RLSA-2026:77359)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:77359 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...

PT-2026-108042

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description Insufficient sanitization of the data-background-iframe attribute allows the bypass of DOMPurify. This issue is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin,...

PT-2026-108115

Name of the Vulnerable Software and Affected Versions OpenStack Mistral versions prior to 23.0.0 Description The std.ssh proxied action passes a caller-supplied proxy command value directly to the paramiko.ProxyCommand function before attempting an SSH connection to a gateway or target host. An...

PT-2026-108307

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6.2 Description In the src/SelectionTranslate.cpp file, selected or pasted translation text is embedded in quoted Windows command lines using incomplete quote-only escaping. This issue affects the...

PT-2026-108295

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.5.3 Description An issue exists where an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting. This command li...

PT-2026-108229

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of command arguments. Th...

CVE-2026-107734: Improper Input Validation

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-94581: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

PT-2026-107839

Name of the Vulnerable Software and Affected Versions SecuShare Pro version 4 Description SecuShare Pro contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. OS Command Injection is a flaw where ...

CVE-2026-85423: Missing Authentication for Critical Function

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-107780: Improper Neutralization of Special Elements used in an OS Command

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...

PT-2026-107804

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection issue exists in the time and zone management subsystem. The system fails to sanitize input values when updating...

CVE-2026-84209: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

PT-2026-108156

Name of the Vulnerable Software and Affected Versions image optimizer Ruby gem versions 1.3.0 through 1.9.0 Description An OS command injection flaw exists in the identify format function. This occurs when the identify option is enabled, allowing attackers to execute arbitrary commands by providi...

PT-2026-107798

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution i...

PT-2026-107768

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...