EUVD-2026-113269

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing remotely authenticated attackers to execute arbitrary code...

PT-2026-132405

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return ...

CVE-2026-107044

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-132840

Name of the Vulnerable Software and Affected Versions @nx/maven versions 22.0.2 through 22.7.8 @nx/maven version 23.1.1 and earlier @nx/gradle versions 21.0.0 through 22.7.8 @nx/gradle version 23.1.1 and earlier Description Project-graph analyzers in certain plugins launch through a shell and...

PT-2026-130631

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.31.2 through 0.40.5 Description The nvm ls function uses a sed program to filter installed versions by embedding the requested version pattern in a ... address. Because backslashes are not escaped, a version...

PT-2026-130610

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1 Description The scripting engine contains a flaw where the system.execute function runs operating system commands without validation or an allow-list of permitted executables. A user with permissions to...

PT-2026-132064

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.3 Description An issue exists where an accepted SIP MESSAGE a text note sent through the phone system can be used to execute FreeSWITCH API commands, including operating system commands. This occurs because...

PT-2026-132504

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate template replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUAL NAME , VIRTUAL ENV , or VIRTUAL PROMPT...

CVE-2026-110193: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-118768: randombit botan: Botan is a C++ cryptography library

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-90865: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations...

CVE-2026-90868: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

PT-2026-132233

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command...

Linux Distros Unpatched Vulnerability : CVE-2026-118692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...