HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection

A flaw was found in the HP Linux Imaging and Printing Software HPLIP. This vulnerability may allow a local attacker to achieve escalation of privileges and/or arbitrary code execution through operating system command injection. This could lead to an attacker gaining unauthorized control over the...

CVE-2026-44098

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

CVE-2026-44098 OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

CVE-2026-44098

CVE-2026-44098 describes an unauthenticated OS command injection in an OCPP backend/agent stack accessible via firewall-bypass. An attacker can control the backend and execute arbitrary commands as the limited user charx-oa, potentially interrupting charging. The connected documents provide the v...

CVE-2026-16524

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

EUVD-2026-50971

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

CVE-2026-16524 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

CVE-2026-16524

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

CVE-2026-16524

CVE-2026-16524 : A command injection flaw affects PCP’s linux_sockets PMDA. The vulnerability allows injection of shell metacharacters via the metric network.persocket.filter, and, due to failed validation, enables arbitrary command execution as the PMDA user during metrics refresh. The CVSSv3.1 ...

CVE-2026-16524 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

EUVD-2026-50969

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

CVE-2026-16524

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. Mitigation To prevent exploitation, restrict access to the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (CVE-2026-14522 & CVE-2026-14519)

Summary IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings. Vulnerability Details CVEID:CVE-2026-14522 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to execute arbitrary commands due to improper neutralization...

PT-2026-66609

Name of the Vulnerable Software and Affected Versions LazyOwn RedTeam/APT Framework versions prior to 0.2.154 Description LazyOwn ships with default C2 credentials in payload.json and core/payload schema.py, which are passed unchanged to lazyc2.py for HTTP Basic authentication. This allows a...

PT-2026-66610

Name of the Vulnerable Software and Affected Versions TR1200 version 2.4.15 TR3000 version 2.4.21 WR300 version 2.4.25 WR1200 version 2.4.23 WR1300 version 2.4.22 WR1500 version 2.3.10 WR3000 version 2.4.19 WR3600 version 2.3.16 WR6500 version 2.3.15 Description A command injection issue exists i...

vim security update

9.1.083-9.0.1.el102.12 - Remove upstream references Orabug: 31197557 2:9.1.083-9.12 - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:9.1.083-9.11 - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution during C omni-completion 2:9.1.083-9.10 -...

Oracle Linux 10 : vim (ELSA-2026-48650)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48650 advisory. - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution...

CVE-2026-38709

CVE-2026-38709 affects multiple devices/firmware revisions, including TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15. The vulnerability is a command injection in the net.set_wan interface , allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-16524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets...

MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)

The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...