F5 iControl REST - Remote Command Execution

F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before...

EUVD-2026-91064

OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

EUVD-2026-91760

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

PT-2026-104453

Name of the Vulnerable Software and Affected Versions PeaZip versions prior to 11.3.0 Description In a non-default configuration, the software is susceptible to OS command injection. This occurs when a filename within an archive is processed and the application mishandles cases where a quotation...

PT-2026-104443

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An authorization flaw exists in the UTMIncidentCommandWebsocket.processCommand function, which handles the '/command/hostname' STOMP destination. The system fails to perform role checks or apply a...

CVE-2026-75937: Improper Neutralization of Special Elements used in an OS Command

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-97876: Untrusted Pointer Dereference

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

PT-2026-104442

Name of the Vulnerable Software and Affected Versions Digi DAL OS affected versions not specified Description An OS Command Injection flaw exists in the web administration interface. An unauthenticated attacker can send a specially crafted HTTP POST request to execute arbitrary operating system...

ROS-20261002-73-0006

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0008

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0010

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-51911: Improper Control of Generation of Code

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-105050: Incorrect Behavior Order: Validate Before Canonicalize

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...

CVE-2026-82041: Missing Authorization

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-104859: Improper Neutralization of Special Elements used in an OS Command

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

PT-2026-104374

Name of the Vulnerable Software and Affected Versions AgentScope version 1.0.20 Description Code injection exists in the execute shell command function located in src/agentscope/tool/ coding/ shell.py. Depending on the exposed entry, an attacker can trigger the execution of attacker-controlled co...

CVE-2026-90970: Improper Neutralization of Special Elements Used in a Template Engine

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

Ubuntu 26.04 LTS : KCoreAddons vulnerability (USN-8857-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8857-1 advisory. It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters,...