dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

foreman: command injection in foreman-rake database tasks

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...

foreman: command injection in foreman-tail

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

rubygem-hammer_cli: command injection via insecure editor invocation

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

Critical: Red Hat Security Advisory: Satellite 6.19.5 Async Update

A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in the crlserver component. An authenticated user with permission to add CRL URLs via BCC , the WSI REST or SOAP API , or the cacrl command-line interface can trigger shell command substitution. This allows the attacker to execute com...

CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

EUVD-2026-90875

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2022-33891-EXPLOIT

CVE-2022-33891 - Apache Spark UI Remote Code Execution RCE 🔐 Apache Spark UI is susceptible to a remote command injection vulnerability identified as CVE-2022-33891. This flaw arises due to improper handling of user authentication and access control, specifically when Access Control Lists ACLs ar...

CVE-2024-3273-EXPLOIT

CVE-2024-3273 - D-Link Remote Code Execution RCE 💥 A critical vulnerability, classified as CVE-2024-3273, was discovered in several D-Link NAS devices, including DNS-320L, DNS-325, DNS-327L, and DNS-340L, up to the date of 20240403. This vulnerability affects an unknown function of the file...

CVE-2024-10914-EXPLOIT

CVE-2024-10914 - D-Link Remote Code Execution RCE This repo contains a proof-of-concept PoC exploit for a critical vulnerability affecting D-Link NAS devices. The bug, tracked as CVE-2024-10914 , impacts the following models: D-Link DNS-320 D-Link DNS-320LW D-Link DNS-325 D-Link DNS-340L The...

CVE-2022-34753-EXPLOIT

CVE-2022-34753 - OS Command Injection in SpaceLogic C-Bus Home Controller CVE-2022-34753 is a critical security vulnerability classified under CWE-78, indicating an "Improper Neutralization of Special Elements used in an OS Command" commonly referred to as 'OS Command Injection'. This vulnerabili...

CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

CVE-2026-76146

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-76146

Genian SSL PNS is subject to an OS command injection vulnerability. An attacker who possesses only the client access ID , without requiring a password, can execute arbitrary commands remotely. No specific remediation details or exploit links were provided in the documentation.