PT-2026-133628

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

CVE-2026-119978: FlowiseAI Flowise: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by…

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOWBUILTINDEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth...

CVE-2026-119586: SQLite: SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits…

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqliteschema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .syst...

PT-2026-133507

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or...

PT-2026-133434

🔴 Dahua Intelligent Connection Center: remote code execution via command injection CVE-2025-31704 A remote attacker can send a specially crafted request to run arbitrary commands on the affected system. Patch → V5.000.0000000.15 https://t.co/0JpnCOlkWo...

VulnCheck KEV: CVE-2025-41656

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

PT-2026-133466

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.7.8 Description Authenticated users with System: Firmware privileges can execute commands as root by providing a malicious firmware mirror URL. This occurs when shell metacharacters are submitted via the 'POST...

PT-2026-133565

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-134207

Name of the Vulnerable Software and Affected Versions MoLing versions prior to 0.5.0 Description When running in SSE mode using the -l flag, the /sse and /message HTTP endpoints do not authenticate requests. Additionally, the mcp-go dependency configures Access-Control-Allow-Origin: , which allow...

PT-2026-134153

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.19 Description An ordinary database user can execute operating system commands on the host machine running pgAdmin 4 as the account running the application. This occurs through the Import/Export Data tool, which...

CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdu...

PT-2026-133664

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

PT-2026-133663

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE REGISTRY LAUNCH HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry...

PT-2026-133447

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-133445

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

PT-2026-133533

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or...

CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool...

PT-2026-133451

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-62863: gojue moling: MoLing is a computer-use and browser-use based MCP server

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: . A malicious web page can open a cross-origin EventSourc...

Important: emacs

Issue Overview: GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992. CVE-2026-108976 Affected Packages: emacs Note:...