DRUPAL-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

EUVD-2026-85420

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

CVE-2026-93349

Frictionless versions through 5.20.0rc1 are vulnerable to an OS command injection in the explore console command. The root cause is the unsanitized passing of resource path values from a datapackage.json descriptor to os.system via a shell. An attacker can supply a crafted descriptor containing s...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

Exploit for CVE-2026-93349

CVE-2026-93349: Frictionless - Package.fromdescriptor...

CVE-2026-76978

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-76978

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to a Command Injection vulnerability within the Diagnose Settings feature. Successful exploitation could allow an attacker to execute arbitrary commands on the affected system. Exploitation details a...

EUVD-2026-85269

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-76978 Command Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-76978 Command Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-15027

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-15027 Changing｜CGServiSign - OS Command Injection

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

EUVD-2026-85168

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-15027

The CGServiSign software developed by Changing contains an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this by inducing victims to visit a malicious web page, which then triggers the injection of arbitrary OS commands through the local service interface . This...

CVE-2026-15027 Changing｜CGServiSign - OS Command Injection

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

EUVD-2026-84985

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...