CVE-2026-105841: Improper Neutralization of Special Elements used in an OS Command

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

Command injection vulnerability exists in the REST API management interface of Brocade Fabric OS (CVE-2026-94581)

: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

PT-2026-107259

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

CVE-2026-25270: Out-of-bounds Write

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

PT-2026-107313

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.6 Description In the ssh component, a command-line username containing a $ or character can lead to injection. Recommendations Update to version 10.6 or later...

OS Command Injection via Fabric Synchronization

: An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys...

PT-2026-107491

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 affected versions not specified Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. This allows a remote authenticated attacker with administrator...

PT-2026-107255

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

PT-2026-107108

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-101207: Improper Neutralization of Special Elements used in an OS Command

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...

Cisco ASA Argument Injection (CVE-2026-20016)

A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attack...

RockyLinux 10 : vim (RLSA-2026:75769)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75769 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly...

CVE-2025-71384

The Dbit WIFI4 N300 1.0.0 devices are vulnerable to a stack-based buffer overflow in the /api/addStaticDHCP comment field. This flaw allows administrators connected to the local Wi-Fi network to achieve remote code execution by executing arbitrary OS commands. While a proof of concept is mentione...

CVE-2026-79815: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint...

CVE-2026-82162: Improper Handling of Mixed Encoding

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-103778: Use of Hard-coded Cryptographic Key

Dell Command | Configure DCC, versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-106746

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

PT-2026-106747

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

Linux Distros Unpatched Vulnerability : CVE-2026-102828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...

PT-2026-107118

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and A...