CVE-2026-14277: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...

CVE-2026-16466: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

CVE-2026-82774: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

MiracleLinux 9 : gpsd-minimal-3.26.1-2.el9_8.2 (AXSA:2026-1819:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1819:03 advisory. gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility CVE-2026-60122 Tenable has extracted the preceding description block directl...

CVE-2026-14276: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...

The software’s vulnerability for providing secure remote access to data through the Palo Alto Networks GlobalProtect App allows a perpetrator to execute arbitrary commands.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

PT-2026-91161

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.1.0 Description Bifrost allows the registration of MCP clients through its management API, where a stdio client consists of a command and arguments. The software starts the program in the gateway...

CVE-2026-57125: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agentyaml, and the approve field can mark executecommand as YAML-approved before @requireapproval checks critical tools. This...

RHEL 7 : sg3_utils (RHSA-2026:67157)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67157 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Cisco Secure_Firewall_Management_Center

CVE-2026-20079 Cisco FMC Read-Only Checker A small, deliberat...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ctags (UTSA-2023-002841)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002841 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filename specified in the command line...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2023-000605)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000605 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

FreeBSD : yt-dlp: Improper Neutralization of Special Elements (cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0 advisory. https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports: yt-dlp and youtube-dl...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-90444 OS Command Injection in Malcolm

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-7863

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...

CVE-2026-89066

CVE-2026-89066 is an OS command injection vulnerability in the task synthesis component of projen (versions before 0.103.0 ). Shell metacharacters present in project configuration values and repository file names are interpolated unsanitized into generated task definitions, allowing arbitrary com...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...