EUVD-2026-109093

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-122097

OS command injection in the root-privileged 'hardware monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.53. This vulnerability stems from the amdgpu driver failing to limit the nesting depth of ATOM command tables, potentially leading to a kernel crash...

Mervin Praison PraisonAI processing logic error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.5.87 up to and including 4.6.59. This vulnerability arises because the recipe.runstream stream execution path fails to perform checks on dangerous tools, allowing recipes declared as executecommand to bypass restrictions ...

PT-2026-122207

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.9 through 21.14.12 Description The bash bin/activate script fails to properly escape dollar signs and backticks when copying the --prompt value into the PS1 environment variable, provided that promptvars and POSIX mod...

phpBB -- multiple vulnerabilities

The phpBB Team reports: Resend rate limiting incorrectly updating expiration time SECURITY-298 Attachment comment hijacking by other users SECURITY-300 Reflected XSS via data passed to registration page SECURITY-301, CVE-2026-87901 Hide oauth provider secrets in ACP SECURITY-302 Potential stored...

PT-2026-135184

Security vulnerability affects the argo-cd package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...

DJI CrystalSky ZS600C command injection vulnerability

Versions DJI CrystalSky ZS600C from 0.3.9.7 through 0.6.6.9 contain a security vulnerability. This vulnerability stems from the absence of authorization checks in the native Binder service android.dji.server. Processing routines fail to verify the caller’s identity or permissions; instead, they...

ROS-20261023-73-0005

The vulnerability of the findbasepath function in the SSHFS file system lies in the ability to exploit or modify arguments. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2026-121838

Name of the Vulnerable Software and Affected Versions Aider versions prior to 0.86.3 Description A command execution issue exists where attackers can run shell commands by committing a malicious .aider.conf.yml file. This configuration file is auto-loaded without a trust prompt, allowing the...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority has identified a command injection vulnerability in virtualenv versions 21.14.9 through 21.14.13. This vulnerability arises because when promptvars and POSIX mode are both disabled, the bash bin/activate script fails to escape dollar signs or backticks within the...

PT-2026-122222

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

Linux Distros Unpatched Vulnerability : CVE-2026-113722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted...

UBUNTU-CVE-2026-114720

Fix IMAP command injection via CRLF in flag parameter of mail/mark action...

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running...

Debian dsa-6579 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6579 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6579-1 [email protected] https://www.debian.org/securit...

CVE-2026-52356

The D-Link DAP1160L A1 running firmware FW101WWb04 is susceptible to an OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint. An attacker can execute arbitrary commands by injecting shell metacharacters into the endpoint. The CVSS 3.1 score for this vulnerability is 8.8 (...

PT-2026-121781

Name of the Vulnerable Software and Affected Versions ASUS routers affected versions not specified Description Improper neutralization of special elements used in an OS command allows a remote user to execute arbitrary commands with root privileges. This occurs when crafted parameters are sent to...

PT-2026-122148

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1 FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-122107

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite ZCS version 10.1.16 Zimbra Collaboration Suite ZCS version 10.1.20 Description An SMTP command injection issue exists in the data-source testing functionality. An authenticated user with account options enabled can...