EUVD-2026-62752

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection...

EUVD-2026-62745

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements...

CVE-2026-16850 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements...

CVE-2026-16850

IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1, are vulnerable to command injection via crafted Router Advertisements, enabling remote arbitrary code execution with HIGH severity (CVSS 8.8). Exploitation details are not provided in the documents; refer to the IBM support advisory for patch information.

EUVD-2026-62742

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options...

CVE-2026-16848

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to remote arbitrary command execution via improper neutralization of shell metacharacters in DHCP options. An unauthenticated attacker on an adjacent network can inject malicious shell characters through DHCP option fields, achieving full confid...

CVE-2026-16844

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to OS command injection (CWE-78) allowing remote arbitrary command execution (CVSS 8.8 HIGH, adjacent network). IBM's support page https://www.ibm.com/support/pages/node/7283858 is the primary reference; no exploitation details or patch versions...

EUVD-2026-62733

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16844 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16842

CVE-2026-16842 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is improper neutralization of special elements in an OS command , enabling a remote attacker to execute arbitrary commands. The attack vector is adjacent network with no privileges or user interaction required (CVSS...

EUVD-2026-62732

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16842 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-62702

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

EUVD-2026-62699

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

CVE-2026-75149

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-76231

A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows a...

CVE-2026-76228

A flaw was found in Renovate. This command injection vulnerability occurs when Renovate processes Gradle Wrapper updates. An attacker can introduce a malicious gradle-wrapper.properties file into a scanned repository, where a specially crafted distributionUrl containing shell command substitution...