193572 matches found
CVE-2026-76279: Improper Input Validation
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to write events to internal indexes outside the index access configured for the role. The vulnerability is...
CVE-2026-102256: Improper Neutralization of Special Elements used in an OS Command
Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...
CVE-2026-106583: Improper Control of Resource Identifiers
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2025-70521: Improper Neutralization of Special Elements used in a Command
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system...
CVE-2026-106058: Improper Neutralization of Special Elements used in an OS Command
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...
PT-2026-107481
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...
CVE-2026-106056: Improper Neutralization of Special Elements used in an OS Command
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...
PT-2026-107593
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...
CVE-2026-76437: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : sg3_utils vulnerability (USN-8874-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8874-1 advisory. Shaomin Chen discovered that sg3utils did not properly sanitize device identification data...
RockyLinux 9 : vim (RLSA-2026:75768)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...
CVE-2026-97674
IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a Code Injection vulnerability (CVE-2026-97674 ). Due to the improper neutralization of special elements used in an OS command, a remote authenticated attacker could execute arbitrary OS commands. This flaw is categorized under CWE-94...
CVE-2026-97674 Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command 'Code Injection', aka improper control of code generation...
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection...
CVE-2026-106583
In OpenSSH versions prior to 10.6 , a vulnerability exists where the presence of a $ or ** character in a command-line username can lead to injection . This issue is associated with CWE-99 (Improper Control of Resource Identifiers). Exploitation details are not provided in the documents, and spec...
