EUVD-2026-112493

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

PT-2026-130610

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1 Description The scripting engine contains a flaw where the system.execute function runs operating system commands without validation or an allow-list of permitted executables. A user with permissions to...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing remotely authenticated attackers to execute arbitrary code...

CVE-2026-104328: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-107044

Insecure permissions within ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allow unauthorized attackers to arbitrarily manipulate the application's MAXS command/transport mechanism . The vulnerability is associated with CWE-732 (Incorrect Permission Assignment for Critical Resource). While the ri...

PT-2026-132504

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate template replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUAL NAME , VIRTUAL ENV , or VIRTUAL PROMPT...

CVE-2026-119282: nrwl, @nx: Nx is a monorepo solution for TypeScript and polyglot codebases

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command argument...

EUVD-2026-113269

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

PT-2026-132405

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return ...

CVE-2026-107044

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

PT-2026-132840

Name of the Vulnerable Software and Affected Versions @nx/maven versions 22.0.2 through 22.7.8 @nx/maven version 23.1.1 and earlier @nx/gradle versions 21.0.0 through 22.7.8 @nx/gradle version 23.1.1 and earlier Description Project-graph analyzers in certain plugins launch through a shell and...

PT-2026-132064

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.3 Description An issue exists where an accepted SIP MESSAGE a text note sent through the phone system can be used to execute FreeSWITCH API commands, including operating system commands. This occurs because...

PT-2026-132331

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...

CVE-2026-118768: randombit botan: Botan is a C++ cryptography library

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

PT-2026-132103

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

PT-2026-132464

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load prepare reuses the...

PT-2026-130631

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.31.2 through 0.40.5 Description The nvm ls function uses a sed program to filter installed versions by embedding the requested version pattern in a ... address. Because backslashes are not escaped, a version...

PT-2026-132216

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.3 Description Remote attackers can execute arbitrary code due to improper neutralization of special elements used in an OS command. This issue occurs when the application fails to properly sanitize...