PT-2026-91066

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91039

Name of the Vulnerable Software and Affected Versions ipa-lab HackingBuddyGPT versions prior to 0.5.1 Description A remote OS command injection is possible due to improper handling of input in the ssh run command function within the src/hackingBuddyGPT/extensions/ssh run command.py file. OS comma...

PT-2026-91031

Name of the Vulnerable Software and Affected Versions GH05TCREW PentestAgent versions up to cf882dabea3ed91cef016cdd115e5426315665a2 Description An OS command injection flaw exists in the MCP HTTP Server component within the run task function of the interface/main.py file. This issue allows a...

PT-2026-91136

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-16466: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

CVE-2026-90703: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2026-17133: Improper Neutralization of Special Elements used in an OS Command

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-82794: Improper Neutralization of Special Elements used in an OS Command

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82791: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-90619: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-57124: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-90706: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

CVE-2026-90894: Improper Neutralization of Argument Delimiters in a Command

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90704: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-59960: Improper Neutralization of Special Elements used in an OS Command

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-82777: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-14275: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

CVE-2026-90705: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90618: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.executecommand of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be...

CVE-2026-54182: Improper Input Validation

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...