PT-2026-132494

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH ENCODING. Under a legacy multibyte codec...

PT-2026-132073

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to...

CVE-2026-107044

Insecure permissions within ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allow unauthorized attackers to arbitrarily manipulate the application's MAXS command/transport mechanism . The vulnerability is associated with CWE-732 (Incorrect Permission Assignment for Critical Resource). While the ri...

PT-2026-132336

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4 Description An OS command injection issue exists in the Windows version of the software. This flaw allows for arbitrary comma...

PT-2026-132333

An OS command injection vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations...

PT-2026-132214

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-132224

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-132343

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

CVE-2026-107326: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command...

Progress Software WS_FTP Server command injection vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a command injection vulnerability. This vulnerability stems from OS command injection and may allow arbitrary commands to be executed under certain configurations...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

PT-2026-132464

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load prepare reuses the...

CVE-2026-118768: randombit botan: Botan is a C++ cryptography library

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-110193: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

Alibaba Cloud Linux 3 : 0329: vim (ALINUX3-SA-2026:0329)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0329 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-73073: Vim is an open source, command line...

PT-2026-132233

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.8 Description A remote attacker with a low-privileged authenticated account can cause the Agentic Assistant to generate or submit component code using unblocked patterns. This can lead to arbitrary...

PT-2026-133261

Summary JobWorkflowExecutor. exec inline python is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by a checking all AST nodes against an allowlist, and b providing a builtins whitelist...

CVE-2026-97854: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product...