PT-2026-128063

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An...

CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

DALIBO PostgreSQL Anonymizer information disclosure vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain an information disclosure vulnerability. This vulnerability arises because salt and shift can access restricted data via the SHOW command; however, it remains visible in pgdbrolesetting or pgroles, potentially leading to information...

PT-2026-128212

Name of the Vulnerable Software and Affected Versions Eclipse Che che-machine-exec affected versions not specified Description The che-machine-exec service is subject to OS command injection. The service constructs shell commands by concatenating user-controlled input into a double-quoted sh -c...

PT-2026-127794

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and r...

PT-2026-127903

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

PT-2026-127915

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an...

Juniper Networks Session Smart Router command injection vulnerability

A command injection vulnerability exists in Juniper Networks Session Smart Router and Juniper Networks Session Smart Conductor versions prior to 7.0.5, versions 7.1.x prior to 7.1.7, and versions 7.2.x prior to 7.2.3. This vulnerability stems from improper handling of special elements within OS...

Dell PowerProtect Data Domain command injection vulnerability

Command injection vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within OS commands, potentially allowing...

FOG Project FOG command injection vulnerability

Versions prior to FOG 1.5.10.2253 and versions prior to 1.6.0-RC-1 contain a security vulnerability. This vulnerability stems from API validation of credentials without enforcing administrator roles. Low-privilege authenticated users with API access can modify the user, pass, and ftppath fields o...

Moxa MAR-2000 FWR_MAR2000_V1.0_Build_15010909 Executer Program Argument Command Injection

Moxa MAR-2000 version FWRMAR2000V1.0Build15010909 contains an authenticated command injection in the Executer program table argument field. The proof of concept uploads a benign script, stores a crafted argument, and activates the program. https://packetstorm.news/download/238062...

Agent launch command approval bypass vulnerability

Since Jenkins 2.86, LTS 2.89.1 launching agents by running a command on the controller is implemented in the Command Agent Launcher Plugin rather than in Jenkins. For backward compatibility with older agent configurations, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch...

CVE-2026-103403: Juniper Networks: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in…

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

Dell PowerProtect Data Domain command injection vulnerability

Versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a command injection vulnerability. This vulnerability stems from improper neutralization of special elements within OS commands OS command...

Linux Distros Unpatched Vulnerability : CVE-2026-116576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into...

CVE-2026-118581: Improper Neutralization of Special Elements in Data Query Logic

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

Ultralytics command injection vulnerability

Version 8.4.65 of Ultralytics contains a command injection vulnerability. This flaw arises because the torchsafeload function fails to perform adequate validation on user-supplied strings prior to invoking system calls; as a result, remote attackers can execute arbitrary code after users have...

PT-2026-129195

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...

PT-2026-129201

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

Dell PowerProtect Data Domain Virtual Edition command injection vulnerability

Versions 7.7.1.0 through 8.8 of Dell PowerProtect Data Domain Virtual Edition, versions 7.13.1.0 through 7.13.1.80 of LTS2024, versions 8.3.1.0 through 8.3.1.40 of LTS2025, and versions 8.6.1.0 through 8.6.1.20 of LTS2026 contain a command injection vulnerability. This vulnerability stems from...