EUVD-2026-75270

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

EUVD-2026-75255

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured...

CVE-2026-0309

CVE-2026-0309 is currently a reserved candidate with no publicly available technical details. The vulnerability has not yet been announced. Monitor for updates once the assigning organization publicizes the entry.

CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured...

CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured...

...[ More ]

This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...

CVE-2026-81048: Improper Neutralization of Special Elements used in a Command

Dell ThinOS 10, versions prior to 260510.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89641

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary commands. This occurs due to improper neutralization of special elements used in an OS command, which...

PT-2026-89397

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

PT-2026-89463

Dell ThinOS 10, versions prior to 2605 10.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89486

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description A remote, authenticated user with the accessCp permission can execute operating system commands with the privileges of the PHP web worker via the Control Panel. Recommendations At the momen...

PT-2026-89399

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...

PT-2026-89614

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Remote authenticated attackers can execute arbitrary commands due to improper validation of command-line arguments within the MCP stdio server configuration. Recommendations Update IBM...

PT-2026-89468

Dell ThinOS 10, versions prior to 2605 10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-89418

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

PT-2026-89318

🚨 HIGH: CVE-2026-88277 CVSS 8.8 - GeoVision GV-LPC2211 V1.13 vulnerable to authenticated command injection via ONVIF. Attackers can execute arbitrary commands as root. Patch immediately. CVE Vulnerability PatchNow https://t.co/0HQ3GCjvsH...

PT-2026-89639

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary code. This occurs due to improper neutralization of special elements used in an OS command, which allow...

PT-2026-89642

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89653

Name of the Vulnerable Software and Affected Versions Deco BE11000 affected versions not specified Deco M9 Plus affected versions not specified Description An OS command injection issue exists in the TDDP module. This allows an attacker on an adjacent network to execute arbitrary commands with ro...

CVE-2026-88282: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...