PT-2026-132224

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-132343

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 versionCode 19 allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism...

CVE-2026-107326: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-104308: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command...

Progress Software WS_FTP Server command injection vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a command injection vulnerability. This vulnerability stems from OS command injection and may allow arbitrary commands to be executed under certain configurations...

PT-2026-132064

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.3 Description An issue exists where an accepted SIP MESSAGE a text note sent through the phone system can be used to execute FreeSWITCH API commands, including operating system commands. This occurs because...

PT-2026-130631

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.31.2 through 0.40.5 Description The nvm ls function uses a sed program to filter installed versions by embedding the requested version pattern in a ... address. Because backslashes are not escaped, a version...

CVE-2026-118905: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, nvmls filters installed versions with a sed program that embeds the requested version pattern in a ... address, escaping . and, since 0.40.4, but not backslash. ...

PT-2026-132464

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load prepare reuses the...

CVE-2026-110193: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server...

PT-2026-132233

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.8 Description A remote attacker with a low-privileged authenticated account can cause the Agentic Assistant to generate or submit component code using unblocked patterns. This can lead to arbitrary...

CVE-2026-97854: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product...

PT-2026-132502

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH VERSION is set, so zsh...

ONT-4GE-RFDW V4.0.6 Authenticated OS Command Injection

ONT-4GE-RFDW versions V4.0.0-210811 and V4.0.6 contain an authenticated OS command injection vulnerability in the Ping Diagnostics Host Address field. A proof of concept demonstrates command execution through this input. https://packetstorm.news/download/238195...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing remote authenticated attackers to cause a denial of service...

Nozomi Networks Guardian command injection vulnerability

Versions prior to Nozomi Networks Guardian 26.4.0 and Nozomi Networks CMC 26.4.0 contain a command injection vulnerability. This vulnerability stems from insufficient validation of update package contents by the update installation functionality; it is susceptible to OS command injection attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

Collabora Online Built-in CODE Server 26.4.302 Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303, bundled as the Nextcloud richdocumentscode app, contain an unauthenticated OS command injection in proxy.php when CODE is not running. The proof of concept writes and accesses a PHP web shell on the target...

Alibaba Cloud Linux 3 : 0329: vim (ALINUX3-SA-2026:0329)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0329 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-73073: Vim is an open source, command line...