CVE-2026-115904: topluyo App: Topluyo is a social networking platform

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks routine in utils.js. An attacker who controls a target URL can...

CVE-2026-118692: giuspen cherrytree: CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows…

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

ROS-20261028-73-0012

Multiple vulnerabilities in the session.c sshd function of the OpenSSH cryptographic library exist due to the lack of safeguards against CRLF sequence handling carriage return followed by a newline. Exploitation of these vulnerabilities enables a remote attacker to bypass command interpreter...

Eclipse Che machine exec command injection vulnerability

In Eclipse Che Machine Exec versions 7.0.0 through 7.122.0, there is a command injection vulnerability. This vulnerability arises because the che-machine-exec service, when constructing shell commands, incorporates user-controllable inputs such as username and namespace fields from the /exec/init...

Gotenberg 8.30.1 ExifTool Argument Injection

Gotenberg versions through 8.30.1 contain an ExifTool argument injection vulnerability in the PDF metadata write endpoint. The proof of concept submits newline-delimited metadata to inject an ExifTool argument and retrieve command output from the target. https://packetstorm.news/download/238043...

Linux Distros Unpatched Vulnerability : CVE-2026-118179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was no...

Juniper Networks Session Smart Router command injection vulnerability

A command injection vulnerability exists in Juniper Networks Session Smart Router and Session Smart Conductor versions prior to 7.0.5, from 7.1.0 up to versions prior to 7.1.7, and from 7.2.0 up to versions prior to 7.2.3. This vulnerability stems from improper handling of special elements within...

CVE-2026-86400: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

TencentOS Server 4: lrzsz (TSSA-2026:1207)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1207 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-86395: Dell PowerProtect Data Domain Virtual Edition: Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-86399: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain an information disclosure vulnerability. This vulnerability arises because salt and shift can access restricted data via the SHOW command; however, it remains visible in pgdbrolesetting or pgroles, potentially leading to information...

PT-2026-128212

Name of the Vulnerable Software and Affected Versions Eclipse Che che-machine-exec affected versions not specified Description The che-machine-exec service is subject to OS command injection. The service constructs shell commands by concatenating user-controlled input into a double-quoted sh -c...

CVE-2026-86396: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

CVE-2026-86394: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

Linux Distros Unpatched Vulnerability : CVE-2026-116576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into...

PT-2026-127794

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and r...

PT-2026-127903

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

PT-2026-127915

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

PT-2026-128070

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...