CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

BuildKit Command Injection

The vulnerability of the BuildKit container-building software lies in the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Glances virsh Command Execution

The vulnerability of the virsh function in the Glances/plugins/vms/engines/virsh.py module of the monitoring tool Glances is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

GitPython Command Injection

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2026-99126

Name of the Vulnerable Software and Affected Versions Mediawiki - ExternalData Extension versions prior to 3.7 Description An OS Command Injection issue exists in the ExternalData extension, which allows unauthenticated remote code execution through wikitext. This occurs due to the improper...

CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

PT-2026-98865

Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...

CVE-2026-100368: Improper Neutralization of Special Elements used in an OS Command

CliInvoke is a .NET library for invoking command-line programs, and its CliInvoke.Specializations packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. CliInvoke.Specializations versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4,...

CVE-2026-42322: Unrestricted Upload of File with Dangerous Type

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

PT-2026-99106

Name of the Vulnerable Software and Affected Versions CliInvoke.Specializations versions 2.2.0 through 2.8.4 CliInvoke.Specializations versions 2.9.0 through 2.9.3 CliInvoke.Specializations versions 2.10.0 through 2.10.4 CliInvoke.Specializations versions 3.0.0-alpha.1 through 3.0.0-alpha.4...

PT-2026-102810

Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via customArgs to the git.clone function. This allows Git to load an attacker-controlled configuration...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

CVE-2026-95832: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...

PT-2026-98890

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description In the 'admin/themes standard pages.php' endpoint, the application validates uploaded logo content by MIME type but uses the attacker-controlled std pgs logo extension when creating the stored...

Glances secure_popen Command Execution

The vulnerability of the securepopen function in the Glances monitoring tool glances/secure.py is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

CVE-2026-100382: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

Linux Distros Unpatched Vulnerability : CVE-2026-77422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in...

Security update for haveged (moderate)

openSUSE security update: security update for haveged ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21958-1 Rating: moderate References: bsc1264086 Cross-References: CVE-2026-41054 CVSS scores: CVE-2026-41054 SUSE : 7.8...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

CVE-2026-85082

The Root Browser Classic 3.3.0 application is vulnerable to an OS command injection due to the improper handling of SQLite database paths. The application passes the file path of a selected database to an operating-system shell without ensuring the filename is safely separated from the command. T...