CVE-2026-51870

DeepTutor version 1.4.0 is vulnerable to OS command injection within the execute function of the /tutorbot/agent/tools/shell.py:ExecTool component. This flaw allows for remote command execution due to the improper neutralization of special elements used in an OS command. While the CVSS v3.1 score...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

PT-2026-103618

Name of the Vulnerable Software and Affected Versions DeepTutor version 1.4.0 Description An OS command injection issue exists in the execute function within the /tutorbot/agent/tools/shell.py:ExecTool component, allowing for remote command execution. Recommendations At the moment, there is no...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

PT-2026-103566

Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description An optional, separately licensed repository-connector feature fails to neutralize special characters in a user-supplied path before passing it to an external command. This allows an...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel (CENTOS7:CLSA-2026:1785244080)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1785244080 advisory. - FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surfac...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2024:1727374287)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1727374287 advisory. - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as globally reachable or...

ALSA-2026:74095 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...

PT-2026-103000

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

PT-2026-103293

Name of the Vulnerable Software and Affected Versions Trex MES versions prior to 2026-09-29 Description Improper neutralization of special elements used in an SQL command allows for SQL injection, which can lead to Command Line Execution. Recommendations Update Trex MES to a version released afte...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2025:1767004508)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1767004508 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1789662396)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789662396 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2025:1767027096)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767027096 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789993238)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789993238 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789993238)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789993238 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to...

CVE-2026-103056: Improper Neutralization of Special Elements used in an OS Command

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

Linux Distros Unpatched Vulnerability : CVE-2026-102422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794

The Ziroom ZHOME A0101 1.0.1.0 is vulnerable to a command injection flaw due to improper processing of the url argument within the /api/ZRnetwork/ping file. This vulnerability allows for remote attack execution. While the exploit has been disclosed to the public and may be used, the vendor has no...