IBM Langflow OSS command injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing remote authenticated attackers to cause a denial of service...

Nozomi Networks Guardian command injection vulnerability

Versions prior to Nozomi Networks Guardian 26.4.0 and Nozomi Networks CMC 26.4.0 contain a command injection vulnerability. This vulnerability stems from insufficient validation of update package contents by the update installation functionality; it is susceptible to OS command injection attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

Collabora Online Built-in CODE Server 26.4.302 Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303, bundled as the Nextcloud richdocumentscode app, contain an unauthenticated OS command injection in proxy.php when CODE is not running. The proof of concept writes and accesses a PHP web shell on the target...

Alibaba Cloud Linux 3 : 0329: vim (ALINUX3-SA-2026:0329)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0329 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-73073: Vim is an open source, command line...

GHSA-3F7J-7JWC-FXFJ systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

Summary On Windows, [email protected] builds a PowerShell command using the value passed to services. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter...

EUVD-2026-110317

systeminformation vulnerable to Windows command injection in services through Unicode quotation marks...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-118755

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

DEBIAN-CVE-2026-118692

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

CVE-2026-118692

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567

AVideo, a video-sharing platform, contains a critical vulnerability in the view/videosListToLive.php endpoint prior to version 8.1.0 . An unauthenticated remote attacker can self-grant isLogged and canStream status by providing a controlled webSiteRootURL, as the system trusts the returned JSON a...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint "view/videosListToLive.php" accepts an attacker-named streamer in "webSiteRootURL", calls "Login::run" in "objects/Login.php", and trusts the returned JSON as session state. An unauthenticated remote attacker who can...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint "install/checkConfiguration.php" assembles "videos/configuration.php" by interpolating request parameters, including "webSiteRootURL", into single-quoted PHP string literals without escaping. An attacker ca...