CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

EUVD-2026-91376

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin...

CVE-2026-93698

A vulnerability in the Multilang adminbin allows for arbitrary command execution due to insufficient validation . This flaw is associated with CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability has a CRITICAL severity score of 9.9 , indicating a high imp...

F5 iControl REST - Remote Command Execution

F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before...

EUVD-2026-91064

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

EUVD-2026-91760

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-97876: Untrusted Pointer Dereference

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

PT-2026-104453

Name of the Vulnerable Software and Affected Versions PeaZip versions prior to 11.3.0 Description In a non-default configuration, the software is susceptible to OS command injection. This occurs when a filename within an archive is processed and the application mishandles cases where a quotation...

PT-2026-104443

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An authorization flaw exists in the UTMIncidentCommandWebsocket.processCommand function, which handles the '/command/hostname' STOMP destination. The system fails to perform role checks or apply a...

PT-2026-104442

Name of the Vulnerable Software and Affected Versions Digi DAL OS affected versions not specified Description An OS Command Injection flaw exists in the web administration interface. An unauthenticated attacker can send a specially crafted HTTP POST request to execute arbitrary operating system...

ROS-20261002-73-0006

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0008

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0010

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-51911: Improper Control of Generation of Code

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-105050: Incorrect Behavior Order: Validate Before Canonicalize

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...