PT-2026-97392

Name of the Vulnerable Software and Affected Versions Frictionless versions prior to 5.20.0rc1 Description An OS command injection flaw exists in the explore console command. An attacker can execute arbitrary operating system commands by providing a crafted Data Package descriptor. By placing she...

PT-2026-97668

Name of the Vulnerable Software and Affected Versions Drupal Cloud versions 0.0.0 through 7.0.1 Description An OS Command Injection issue exists in the Cloud module, which allows users to manage cloud resources. The module fails to sufficiently sanitize the Git branch and repository URL values...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81537: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Critical) (RHSA-2026:71113)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71113 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Linux Distros Unpatched Vulnerability : CVE-2026-94106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...

CVE-2026-84714: Incomplete List of Disallowed Inputs

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...

PT-2026-97551

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...

PT-2026-97595

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

PT-2026-97264

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

CVE-2026-84502: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

PT-2026-97603

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An OS command injection flaw allows a remote authenticated attacker to execute arbitrary code on the system. Recommendations At the moment, there is no information about a newer...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

CVE-2026-6935: Uncontrolled Search Path Element

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code...

Penpot 2.17.2 Arbitrary File Overwrite

Penpot versions 1.20 through 2.17.2 contain a missing authorization vulnerability in the file import RPC command. An authenticated attacker can supply the identifier of another user's file to overwrite its contents and re-parent the file into an attacker-controlled project, resulting in file...

CVE-2026-93349: Improper Neutralization of Special Elements used in an OS Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...