CVE-2026-76146 Genians, Inc Genian SSL PNS OS Command Injection

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

CVE-2026-76146

Genian SSL PNS is subject to an OS command injection vulnerability. An attacker who possesses only the client access ID , without requiring a password, can execute arbitrary commands remotely. No specific remediation details or exploit links were provided in the documentation.

EUVD-2026-90488

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research THOR team, which analyzed the...

PT-2026-104025

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description An OS Command Injection flaw exists in Johnson Controls EasyIO FS32, which allows an attacker to execute arbitrary operating system commands on the affected device. Recommendations Update EasyIO...

PT-2026-104024

Name of the Vulnerable Software and Affected Versions Johnson Controls EasyIO FS32 versions prior to 3.0b63 Description An OS Command Injection flaw exists in the system, which allows an attacker to execute arbitrary operating system commands. Recommendations Update Johnson Controls EasyIO FS32 t...

PT-2026-103902

Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...

CVE-2026-12541: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...

CVE-2026-12540: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

CVE-2026-103505: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_19176)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619176 advisory. cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-0865 cpython: CPython: Logging Bypass in Legacy .pyc File Handling...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc Multiple Vulnerabilities (crlsa-2026_8473)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268473 advisory. dotnet: .NET: Security Bypass and Denial of Service Vulnerability CVE-2026-26171 dotnet: .NET: Denial of Service via stack overflow CVE-2026-32203 dotnet:...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS-STREAM8:CLSA-2026:1779583844)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1779583844 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...

Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_4798)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224798 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (ALMALINUX9.2:CLSA-2026:1787153216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787153216 advisory. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1778145319)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1778145319 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...

Rocky Linux 8 [CIQ] Security Update: hplip / hplip-common / hplip-debuginfo / hplip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_26335)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202626335 advisory. HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection CVE-2026-8632 HPLIP: HPLIP: Arbitrary code executio...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1773222843)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1773222843 advisory. - There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during...

CVE-2026-102294: Improper Neutralization of Special Elements used in an OS Command

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-12542: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...