EUVD-2026-46752

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite component: PJM Command Center. The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing...

EUVD-2026-46736

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite component: PJM Command Center. The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing...

EUVD-2026-46571

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite component: Enterprise Command Center. The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

PT-2026-63410

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

PT-2026-63510

Name of the Vulnerable Software and Affected Versions oclif versions prior to 4.23.17 Description An OS command injection issue exists in the JIT Plugin Entry Handler component. A local attacker can manipulate the jitPlugins argument to execute arbitrary commands via the child process.exec...

PT-2026-63512

Name of the Vulnerable Software and Affected Versions syncfusion ej2-javascript-ui-controls versions prior to 33.2.4 Description An OS command injection flaw exists when the software is accessed locally. The issue resides in the child process.exec function within the package.json file, where...

PT-2026-63463

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low privileges can perform unauthorized reads and writes on data protected by role-based query-level access controls. This occurs due ...

PT-2026-63483

Name of the Vulnerable Software and Affected Versions Compass affected versions not specified Description When importing connections, it is possible to override connection options that are typically restricted to the connection form. Specifically, a custom browser open command can be provided for...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...

PT-2026-63363

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

PT-2026-63364

Name of the Vulnerable Software and Affected Versions Ansible Lightspeed Visual Studio Code extension affected versions not specified Description A command injection flaw exists where the extension fails to properly validate user input as a file path within the ansible.python.activationScript...

PT-2026-63273

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

AlmaLinux 10 : perl-HTTP-Daemon (ALSA-2026:36189)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36189 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

PT-2026-63374

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

SUSE CVE-2026-56624

Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or...

SUSE CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

CVE-2026-16489 affects jsforce up to 3.10.16 in the SFDX Connection Registry. The vulnerability targets the function _execCommand within lib/registry/sfdx.js, enabling OS command injection from a local environment. An exploit is publicly available; the issue was reported early but no remediation ...