CVE-2026-83772: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-67394: Improper Neutralization of Special Elements used in an OS Command

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-84233: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

PT-2026-89829

Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is local url check, reported by Milan Hoppe F...

PT-2026-84485

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Authenticated command injection flaws exist in the command line interface. Successful exploitation allows a privileged user to execute arbitrary commands on the underlying operating system...

PT-2026-84293

Name of the Vulnerable Software and Affected Versions rpm affected versions not specified Description A flaw exists in the rpmuncompress -x command where the command line is constructed using the input filename. A local attacker can provide a specially crafted .gem filename containing RPM macro...

CVE-2026-83549: Improper Neutralization of Special Elements used in an OS Command

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-84361: Improper Neutralization of Special Elements used in an OS Command

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

CVE-2026-73753: Improper Neutralization of Special Elements used in an OS Command

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

PT-2026-84484

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Command injection flaws in the API endpoint allow an authenticated remote attacker with administrative privileges to inject and execute arbitrary commands as a privileged user on the underlyin...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

PT-2026-84421

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A command injection flaw in the web-based management interface allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating...

PT-2026-84213

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An OS Command Injection issue exists, which occurs when an application fails to properly neutralize special elements used in an OS command. This could allow the...

PT-2026-84315

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An OS Command Injection issue exists where an authenticated user with limited privileges can execute arbitrary commands with root privileges. OS Command Injection is a flaw that allow...

CVE-2026-73717: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...

PT-2026-84413

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacke...

PT-2026-84519

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...

CVE-2026-25706: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root ...

PT-2026-84140

A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The...