PT-2026-132503

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

PT-2026-132414

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be...

CVE-2026-33924: Nozomi Networks: Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient…

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to...

PT-2026-132494

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH ENCODING. Under a legacy multibyte codec...

PT-2026-130610

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1 Description The scripting engine contains a flaw where the system.execute function runs operating system commands without validation or an allow-list of permitted executables. A user with permissions to...

PT-2026-132331

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed...

PT-2026-132205

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command...

EUVD-2026-113269

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

PT-2026-132405

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return ...

CVE-2026-90865: Progress Software WS_FTP Server: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations...

PT-2026-132840

Name of the Vulnerable Software and Affected Versions @nx/maven versions 22.0.2 through 22.7.8 @nx/maven version 23.1.1 and earlier @nx/gradle versions 21.0.0 through 22.7.8 @nx/gradle version 23.1.1 and earlier Description Project-graph analyzers in certain plugins launch through a shell and...

PT-2026-132501

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

CVE-2026-107044

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

nvm.sh Node Version Manager command injection vulnerability

A security vulnerability exists in nvm.sh versions 0.31.2 through 0.40.5. It arises because nvmls fails to properly escape backslashes within version strings when using the sed program to filter installed versions. Version strings containing or \ are interpreted as a sequence of ...; the rest of...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing remotely authenticated attackers to execute arbitrary code...

Centereon authorization issue vulnerability

Versions of Centreon prior to 25.10 and between 25.10.9 and 25.10.9, as well as versions between 24.10 and 24.10.21 and between 24.04 and 24.04.25 contain an authorization issue vulnerability. This vulnerability stems from improper functional-level authorization and may allow authenticated users ...

Fedora 45 : accessibility-inspector / akonadi-calendar / akonadi-calendar-tools / etc (2026-21f4914bca)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-21f4914bca advisory. KDE Plasma 6.8.1 + Gear 28.08.2 And related rebuilds ---- - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the...

CVE-2025-13050: Centreon: Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user...

PT-2026-132498

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...

Linux Distros Unpatched Vulnerability : CVE-2026-118692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell...