EUVD-2026-85709

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

CVE-2026-82370

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

PT-2026-97840

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

PT-2026-97839

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary code due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-95519: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-79761: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-81539: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-93425: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

PT-2026-98316

Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...

PT-2026-98294

Name of the Vulnerable Software and Affected Versions react-native-debugger versions prior to 0.14.1 Description An OS command injection flaw exists in the Open in Editor Handler component. The issue occurs within the openDevTools function located in the electron/window.js file, where improper...

PT-2026-98268

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-93289: Improper Neutralization of Special Elements used in an OS Command

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process...

CVE-2026-79766: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

PT-2026-105044

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

PT-2026-97842

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-81545: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-81548: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-81552: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

PT-2026-97799

Name of the Vulnerable Software and Affected Versions rpm affected versions not specified Description A command injection flaw exists when installing or rebuilding a source RPM. If the source or spec file basenames contain a % macro construct, the software executes an attacker-controlled shell...