Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...

PT-2026-132331

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-110317

systeminformation vulnerable to Windows command injection in services through Unicode quotation marks...

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

GHSA-3F7J-7JWC-FXFJ systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

CVE-2026-118692

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567

AVideo, a video-sharing platform, contains a critical vulnerability in the view/videosListToLive.php endpoint prior to version 8.1.0 . An unauthenticated remote attacker can self-grant isLogged and canStream status by providing a controlled webSiteRootURL, as the system trusts the returned JSON a...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61564

The AVideo video-sharing platform is vulnerable to PHP code injection and SQL injection in the unauthenticated installer endpoint install/checkConfiguration.php prior to version 8.1.0 . The root cause is the lack of escaping when interpolating request parameters, such as webSiteRootURL, into sing...

EUVD-2026-110035

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE...

CVE-2026-118755 Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

CVE-2026-118755 Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...