Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise from the failure to verify whether an administrator has approved the startup command in the old agent configuration when converting it to a launcher provided by th...

PT-2026-128302

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An issue exists where launch commands in older agent configurations are converted into launchers provided by the Command Agent Launcher Plugin without...

CVE-2026-118477: EISGE Kalifast: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection

The eigitrepourl parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker free registration available to execute arbitrary commands on the KaliFast server with www-data privileges...

(0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper...

(0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torchsafeload...

PT-2026-128216

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

NETGEAR RAX120 V1.2.5.18 SOAP InstallApp Command Injection

NETGEAR RAX120 version V1.2.5.18 contains an authenticated SOAP InstallApp application-name command injection. The proof of concept sends a crafted request that executes a supplied command on the affected router. https://packetstorm.news/download/238065...

PT-2026-128211

The ei git repo url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker free registration available to execute arbitrary commands on the KaliFast server with www-data...

Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90 Command Injection

Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 version 3.90 contain an operating system command injection vulnerability in the web interface listbaseconfig.php template parameter. The supplied proof of concept writes and retrieves a marker file to verify command execution...

PT-2026-128322

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

PT-2026-128279

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

Juniper Networks Session Smart Router command injection vulnerability

A command injection vulnerability exists in Juniper Networks Session Smart Router and Session Smart Conductor versions prior to 7.0.5, from 7.1.0 up to versions prior to 7.1.7, and from 7.2.0 up to versions prior to 7.2.3. This vulnerability stems from improper handling of special elements within...

Eclipse Che machine exec command injection vulnerability

In Eclipse Che Machine Exec versions 7.0.0 through 7.122.0, there is a command injection vulnerability. This vulnerability arises because the che-machine-exec service, when constructing shell commands, incorporates user-controllable inputs such as username and namespace fields from the /exec/init...

Alpine iLX-F511 command injection vulnerability

The Alpine iLX-F511 running version 7.0.000 contains a command injection vulnerability. This flaw arises because the diagapp component executes system calls without properly validating user-supplied strings, potentially allowing attackers with physical access to execute arbitrary code as root...

Juniper Networks Session Smart Conductor command injection vulnerability

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.x prior to 7.1.7, and versions 7.2.x prior to 7.2.3 contain a command injection vulnerability. This vulnerability arises from improper handling of special elements within OS commands by AutomatedProvisioner; remote...

Dell PowerProtect Data Domain command injection vulnerability

Versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a command injection vulnerability. This vulnerability stems from improper handling of special elements within OS commands, potentially allowing...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from stack buffer overflows and may allow unauthenticated remote attackers to execute...

CVE-2026-86400: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-103780: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An...

CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...