PT-2026-132233

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-110193: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-118768: randombit botan: Botan is a C++ cryptography library

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-90865: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations...

CVE-2026-90868: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

PT-2026-132840

Name of the Vulnerable Software and Affected Versions @nx/maven versions 22.0.2 through 22.7.8 @nx/maven version 23.1.1 and earlier @nx/gradle versions 21.0.0 through 22.7.8 @nx/gradle version 23.1.1 and earlier Description Project-graph analyzers in certain plugins launch through a shell and...

PT-2026-130631

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.31.2 through 0.40.5 Description The nvm ls function uses a sed program to filter installed versions by embedding the requested version pattern in a ... address. Because backslashes are not escaped, a version...

PT-2026-130610

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1 Description The scripting engine contains a flaw where the system.execute function runs operating system commands without validation or an allow-list of permitted executables. A user with permissions to...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...

Linux Distros Unpatched Vulnerability : CVE-2026-118692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell...

PT-2026-132064

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.3 Description An issue exists where an accepted SIP MESSAGE a text note sent through the phone system can be used to execute FreeSWITCH API commands, including operating system commands. This occurs because...

EUVD-2026-110317

systeminformation vulnerable to Windows command injection in services through Unicode quotation marks...

GHSA-3F7J-7JWC-FXFJ systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...