94519 matches found
PT-2026-89894
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync server daemon on TCP port 13136. The daemon...
PT-2026-89884
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2023.8.0 through 2023.8.10 Puppet Enterprise versions 2025.0.0 through 2025.11.2 Description An authenticated user with administrative privileges can execute arbitrary shell commands by providing a specially crafted...
PT-2026-89887
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...
CVE-2026-7863: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...
CVE-2026-17176: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized...
netrw.vim Command Execution
The vulnerability of the NetrwLocalRmFile function in the runtime/pack/dist/opt/netrw/autoload/netrw.vim file of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability could allow an attacker to...
CVE-2026-85979: Improper Neutralization of Special Elements used in an OS Command
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without...
PT-2026-90491
TRC analysis reveals attackers exploiting MikroTik RouterOS vulnerabilities to compromise network infrastructure and pivot across segments. Missing authentication flaws CVE-2024-67277 and command injection CVE-2024-86060 enable total device control. Runtime segmentation helps contain...
CVE-2026-90444: Improper Neutralization of Special Elements used in an OS Command
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2026-17176
TP-Link Deco BE11000 is affected by an OS command injection vulnerability in its TDDP module . An attacker on the adjacent network can exploit this by sending a crafted UDP packet , executing arbitrary commands with root privileges without any prior authentication. Successful exploitation may lea...
CVE-2026-17176 OS Command Injection Vulnerability in Deco Devices
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized...
CVE-2026-17176 OS Command Injection Vulnerability in Deco Devices
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized...
GHSA-4X45-GXVP-6283 @argos-ci/core: CI Branch Name OS Command Injection
CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...
@argos-ci/core: CI Branch Name OS Command Injection
CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...
CVE-2026-82095
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-82098
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-82099
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-81550
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-78575
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...