PT-2026-99126

Name of the Vulnerable Software and Affected Versions Mediawiki - ExternalData Extension versions prior to 3.7 Description An OS Command Injection issue exists in the ExternalData extension, which allows unauthenticated remote code execution through wikitext. This occurs due to the improper...

PT-2026-98859

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated attacker can exploit a command injection flaw in the GIM bundle import functionality. By providing a specially crafted GIM bundle, an attacker can pass controlled arguments...

CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

PT-2026-98807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the system fails to reject command chains that contain no commands. When the command count variable is zero, the payload length check...

CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

PT-2026-98805

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethosu accelerator driver where the command stream parser incorrectly interprets bits 15:14 of NPU SET IFM,OFM PRECISION as an activation storage mode on U65...

CVE-2026-85082: Improper Neutralization of Special Elements used in an OS Command

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

Linux Distros Unpatched Vulnerability : CVE-2026-97913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not...

Linux Distros Unpatched Vulnerability : CVE-2026-98004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the...

Linux Distros Unpatched Vulnerability : CVE-2026-95832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49....

Redis 8.2.x < 8.2.9 / 8.4.x < 8.4.6 / 8.6.x < 8.6.6 / 8.8.x < 8.8.2 / 8.10.x < 8.10.1 Multiple Vulnerabilities

The version of Redis installed on the remote host is 8.2.x prior to 8.2.9, 8.4.x prior to 8.4.6, 8.6.x prior to 8.6.6, 8.8.x prior to 8.8.2, or 8.10.x prior to 8.10.1. It is, therefore, affected by multiple vulnerabilities: - A use-after-free vulnerability in the tlsProcessPendingData function,...

Glances virsh Command Execution

The vulnerability of the virsh function in the Glances/plugins/vms/engines/virsh.py module of the monitoring tool Glances is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

GitPython Command Injection

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

BuildKit Command Injection

The vulnerability of the BuildKit container-building software lies in the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-98865

Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

Linux Distros Unpatched Vulnerability : CVE-2026-77422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in...

CVE-2026-100368: Improper Neutralization of Special Elements used in an OS Command

CliInvoke is a .NET library for invoking command-line programs, and its CliInvoke.Specializations packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. CliInvoke.Specializations versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4,...

CVE-2026-42322: Unrestricted Upload of File with Dangerous Type

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-95832: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...