EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84974

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84973

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-84977

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84975

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...

CVE-2026-94367

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...

PT-2026-97615

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Unauthenticated remote command injection in the orchestrator HTTP service allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container...

PT-2026-97307

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.710 ManageEngine Firewall Analyzer versions prior to 12.8.710 Description A command injection issue exists within the Diagnose Settings feature. Command injection is a flaw that allows an attacker ...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-84502: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

CVE-2026-82369: Improper Neutralization of Special Elements used in an OS Command

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-93349: Improper Neutralization of Special Elements used in an OS Command

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in...

PT-2026-97571

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

PT-2026-97668

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

CVE-2026-77601: Improper Neutralization of Special Elements used in an OS Command

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

PT-2026-97240

Name of the Vulnerable Software and Affected Versions CGServiSign affected versions not specified Description An OS Command Injection flaw exists in CGServiSign. Unauthenticated remote attackers can trick victims into visiting a malicious web page to inject arbitrary operating system commands...

PT-2026-97597

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary commands. This occurs due to improper neutralization of special elements used in an OS command, which...

CVE-2026-76978: Improper Neutralization of Special Elements used in an OS Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...