PT-2026-126356

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands...

PT-2026-126320

Name of the Vulnerable Software and Affected Versions HiRDB Server versions 10-00 through 10-12-00 HiRDB Server versions 09-00 through 09-66-22 HiRDB Server with Additional Function Version 9 versions 09-00 through 09-66/V HiRDB Server Version 932 versions 09-02 through 09-66-22 HiRDB Server with...

PT-2026-127217

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-90464: Improper Link Resolution Before File Access

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...

PT-2026-126440

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high...

PT-2026-126417

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...

PLANET WGS-804HPT and WGS-4215 OS Command Injection (CVE-2025-46272)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

PT-2026-126387

In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent...

PT-2026-126705

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

SuperMicro MBD-X12SPI trust management issue vulnerability

The SuperMicro MBD-X12SPI version 01.07.20 contains a trust management vulnerability. This flaw stems from BMC’s failure to properly enforce integrity and encryption requirements for IPMI commands, potentially allowing attackers to execute arbitrary commands within active sessions via specially...

CVE-2026-116676: Improper Neutralization of Special Elements used in an OS Command

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

PT-2026-126390

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

PT-2026-126428

Name of the Vulnerable Software and Affected Versions Kali-GPT versions prior to commit a608c74 Description An OS command injection exists in the execute tool function within kali gpt/tools/mcp server.py. This issue allows MCP clients or prompt-injected agents to execute arbitrary commands as the...

Desmond Morris Tesseract for node.js command injection vulnerability

Desmond Morris Tesseract for node.js versions 0.2.7 and earlier contain a command injection vulnerability. This vulnerability stems from improper handling of the ‘image’ parameter in the process function within the lib/tesseract.js file in the Command Builder component, potentially allowing OS...

Tanium Threat Response command injection vulnerability

Versions prior to Tanium Threat Response 4.9.476, versions prior to 4.12.349, and versions prior to 4.17.327 contain a command injection vulnerability. This vulnerability stems from an issue related to unauthorized code execution, which may allow attackers to execute arbitrary code...

CVE-2026-118179: Undefined Security Weakness

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary...

PT-2026-127754

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

Moxa OnCell G3150A-LTE Series command injection vulnerability

The Moxa OnCell G3150A-LTE Series version 1.0.0 contains a command injection vulnerability. This vulnerability stems from insufficient input validation in the SMS management functionality, potentially allowing remote attackers with appropriate privileges to execute arbitrary commands...

PT-2026-125888

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...