CVE-2026-85013: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

VulnCheck KEV: CVE-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

VulnCheck KEV: CVE-2024-58385

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...

PT-2026-92450

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in a component allows an authenticated remote attacker to execute arbitrary commands by providing specially crafted input. Successful exploitation ca...

PT-2026-92120

Name of the Vulnerable Software and Affected Versions Yonyou U8 CRM affected versions not specified Description An unauthenticated SQL injection exists in the 'fillbacksettingedit.php' endpoint. By using the DontCheckLogin=1 parameter, authentication is bypassed, and the id parameter is...

PT-2026-92148

Name of the Vulnerable Software and Affected Versions IBM Verify Identity Access affected versions not specified Description Improper validation of user supplied input could allow an administrator to execute additional commands they are not entitled to. Recommendations At the moment, there is no...

CVE-2026-47424: Protection Mechanism Failure

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

PT-2026-92125

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

CVE-2026-12101: Authentication Bypass by Alternate Name

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

CVE-2026-89026: Use of Hard-coded Cryptographic Key

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-63443: Incorrect Authorization

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

PT-2026-91900

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

The vulnerability of the email analysis mechanism of the Cisco AsyncOS operating system for Cisco Secure Email protection tools allows for the execution of arbitrary commands.

The vulnerability of the email analysis mechanism of Cisco AsyncOS operating system in Cisco Secure Email protection solutions is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with roo...

Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

MAL-2026-16162 Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

CVE-2026-14275

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-14277

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...

CVE-2026-14275 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-14275

CVE-2026-14275 affects IBM i Access Client Solutions (ACS) , versions 1.1.2.0 through 1.1.9.15. An authenticated user can execute arbitrary commands with normal user privileges by exploiting improper validation of user-supplied input in a STRPCCMD CL command (CWE-78, OS Command Injection). The vu...

CVE-2026-14276 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...