PT-2026-127913

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

PT-2026-128302

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An issue exists where launch commands in older agent configurations are converted into launchers provided by the Command Agent Launcher Plugin without...

Agent launch command approval bypass vulnerability

Since Jenkins 2.86, LTS 2.89.1 launching agents by running a command on the controller is implemented in the Command Agent Launcher Plugin rather than in Jenkins. For backward compatibility with older agent configurations, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch...

(0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torchsafeload...

(0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper...

CVE-2026-61564: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

Linux Distros Unpatched Vulnerability : CVE-2026-116576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into...

PT-2026-128322

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

PT-2026-128279

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

Rocky Linux 9 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_89755)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689755 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

Linksys WAG200G command injection vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain a command injection vulnerability. This vulnerability arises from OS command injection via the timerinterval parameter. Attackers can send specially crafted POST requests to setup.cgi to launch telnetd or download and execute backdoors,...

PT-2026-127904

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.80 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.40 Dell PowerProtect Data Domain versions 8.6.1.0 through...

PT-2026-128211

The ei git repo url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker free registration available to execute arbitrary commands on the KaliFast server with www-data...

PT-2026-128070

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-128091

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

PT-2026-127903

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

PT-2026-127914

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-129212

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0 Description An unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters, such as webSiteRootURL, when interpolating them into single-quoted PHP string literals to creat...

PT-2026-128282

Name of the Vulnerable Software and Affected Versions Juniper Networks Session Smart Conductor affected versions not specified Description An improper neutralization of special elements used in an OS command within the AutomatedProvisioner allows a remote attacker to execute arbitrary commands wi...