PT-2026-87179

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

PT-2026-88053

Name of the Vulnerable Software and Affected Versions Azure HDInsights affected versions not specified Description An os command injection issue exists, which occurs when an application fails to properly neutralize special elements used in an operating system command. This allows an authorized...

PT-2026-87547

Name of the Vulnerable Software and Affected Versions Windows Program Compatibility Assistant Service affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an authorized attacker to elevate privileges locally...

PT-2026-88440

Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description An issue exists where shell metacharacters in SNMP configuration values are not neutralized before being used by a privileged script to construct OS commands. An authenticated loc...

PT-2026-87014

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...

RHEL 9 : redhat-ds:12 (RHSA-2026:64780)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64780 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

EulerOS 2.0 SP12 : perl-GD (EulerOS-SA-2026-3367)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle...

EulerOS 2.0 SP12 : dracut (EulerOS-SA-2026-3257)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

RHEL 9 : redhat-ds:12 (RHSA-2026:64782)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:64782 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol LDAP...

EulerOS 2.0 SP12 : perl-GD (EulerOS-SA-2026-3292)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle...

Fedora 43 : emacs (2026-6b1a89dfe6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6b1a89dfe6 advisory. Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp Tenable has extracted the preceding description block directly from t...

RHEL 8 : redhat-ds:11 (RHSA-2026:64792)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64792 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

EulerOS 2.0 SP12 : dracut (EulerOS-SA-2026-3332)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

CVE-2026-69534: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...

PT-2026-88290

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary...

PT-2026-88064

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclos...

PT-2026-87096

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-83948: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execute code over a network...

PT-2026-88109

Name of the Vulnerable Software and Affected Versions Microsoft Azure CLI affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an authorized attacker to execute arbitrary code over a network. Recommendations ...