CVE-2026-84694: Improper Neutralization of Special Elements used in an OS Command

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

CVE-2026-79755: Improper Neutralization of Special Elements used in an OS Command

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace= " command that is executed via the host...

CVE-2026-79756: Improper Neutralization of Special Elements used in an OS Command

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-84838: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84837: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-53611: Improper Neutralization of Special Elements used in an OS Command

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

CVE-2025-46418

Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...

PT-2026-84802

Name of the Vulnerable Software and Affected Versions rpmuncompress affected versions not specified Description A command injection flaw exists in rpmuncompress that allows a local attacker to execute arbitrary commands. The issue occurs when the tool processes a specially crafted archive filenam...

PT-2026-84801

Name of the Vulnerable Software and Affected Versions rpm affected versions not specified Description A command injection flaw exists in rpm. An attacker can execute arbitrary commands with the privileges of the build user by influencing the path or filename of a tarball processed by the rpmbuild...

PT-2026-84823

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=" command that is executed via the host...

EUVD-2025-210821

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

CVE-2026-52831: Improper Neutralization of Special Elements used in an OS Command

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

OS command injection vulnerability on agents in tics

tics 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes. This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build. tics 2026.1.0 correctly escapes...

CVE-2025-46418: Improper Neutralization of Special Elements used in an OS Command

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

CVE-2025-46418

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

CVE-2025-46418

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

PT-2026-84824

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

PT-2026-84758

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

Linux Distros Unpatched Vulnerability : CVE-2026-84233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes...

Linux Distros Unpatched Vulnerability : CVE-2026-84837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to...