CVE-2026-85426: Improper Neutralization of Special Elements used in an OS Command

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-85224: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85222: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85012: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-71963: Improper Neutralization of Special Elements used in an OS Command

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...

CVE-2026-35160: Improper Neutralization of Special Elements used in an OS Command

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-85040: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-84830: Improper Neutralization of Special Elements used in an OS Command

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges...

PT-2026-85260

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon center.cgi of the component Add-On Center. Such manipulation of the argument f name/f url/f flag/f login user leads to os command injection. It is...

Fullhan FH8626V100 Command Injection / Secret Disclosure

Fullhan FH8626V100 suffers from command injection, secret disclosure, and multiple other vulnerabilities. Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities Date: 31-03-2026 Exploit Author: Amir Aliu Vendor Homepage: https://www.fullhan.com/ Software Link: N/A - OEM/whitelabel IP camera...

Linux Distros Unpatched Vulnerability : CVE-2026-84372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...

Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities

The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities: - The cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This iss...

CVE-2026-85223: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

TencentOS Server 2: dracut (TSSA-2026:0970)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0970 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-84361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an...

CVE-2026-63694: Improper Neutralization of Special Elements used in a Command

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...

PT-2026-85202

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

PT-2026-84914

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...