CVE-2026-81942

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

EUVD-2026-83045

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533

spatie Scotty (a Laravel package) is affected by an OS command injection in the Doctor Command Handler component, specifically in the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions within app/Commands/DoctorCommand.php. The vulnerability exists in versions up to...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2025-14754

IBM Cloud Pak for Data 5.1.2 is vulnerable to OS command injection (CWE-78) due to improper validation of user-supplied input. An authenticated remote attacker can exploit this to execute arbitrary commands with elevated privileges, potentially leading to full system compromise. The CVSS 3.1 base...

EUVD-2025-210937

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-81942

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) contains an OS command injection vulnerability in its web server . User-supplied input is passed to system() without sufficient filtering, enabling a remote authenticated attacker to execute arbitrary commands on the underlying OS a...

EUVD-2026-82987

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-88622

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...

OPENSUSE-SU-2026:21878-1 Security update for ruby3.4

This update for ruby3.4 fixes the following issues: - CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations bsc1250016. - CVE-2026-27820: insufficient checks in zstreambufferungets can lead to a buffer overflow bsc1259239. - CVE-2026-41316: erb: @init...

[SECURITY] [DLA 4785-1] zip security update

Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS Package : zip Version : 3.0-13+deb12u1 CVE ID : CVE-2018-13410 Debian Bug : 903196 1005943 1077054 1093629 1143866 Multiple minor...

OPENSUSE-SU-2026:21874-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-67322: environment-variable exfiltration in Repo.clonefrom URL via os.path.expandvars bsc1273357. - CVE-2026-67323: unguarded Git options passed as keyword arguments in Repo.archive and git.lsremote allow for command injectio...

OS Command Injection

@cyclonedx/cyclonedx-npm is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of the untrusted --workspace value when constructing a Windows shell command, which allows an attacker to inject shell metacharacters and execute arbitrary operating-system commands...

PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...