CVE-2026-110243 Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

CVE-2026-107861 Kiloview E3 NDI Encoder OS Command Injection

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

CVE-2026-107861 Kiloview E3 NDI Encoder OS Command Injection

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

CVE-2026-107861

The Kiloview E3 NDI encoder is vulnerable to an OS command injection flaw within its firmware. The system control service fails to properly sanitize the hostname parameter accepted by the device naming endpoint, which is subsequently passed unquoted into a shell command. An authenticated web user...

CVE-2026-109122

The Kiloview E3 NDI encoder firmware contains an OS Command Injection vulnerability in its network management service. The service fails to properly sanitize a field used when configuring static routes via the web management API. An authenticated web user with permission to configure static route...

CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

CVE-2026-105014

The Azure Pipelines service is vulnerable to a command injection flaw caused by the improper neutralization of special elements used in a command. This vulnerability allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability has a CRITICAL base severity score of 9...

CVE-2026-72092

A flaw was found in the Linux kernel. A local user could trigger a kernel crash by submitting a command to an AMD XDNA device that does not support the command submission operation. This leads to a Denial of Service DoS...

Command Injection

Overview aws-sam-cli is an AWS SAM CLI is a CLI tool for local development and testing of Serverless applications Affected versions of this package are vulnerable to Command Injection via the Makefile generator in makefilegenerator.py, which interpolates an attacker-controlled Terraform resource...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the requirerequestheader process. An attacker can cause the Agent and Proxy services to shut down by sending requests to /agent/v1/quit or /proxy/v1/quit endpoints without the required header via server-side...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the requirerequestheader process. An attacker can cause the Agent and Proxy services to shut down by sending requests to /agent/v1/quit or /proxy/v1/quit endpoints without the required header via server-side...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the requirerequestheader process. An attacker can cause the Agent and Proxy services to shut down by sending requests to /agent/v1/quit or /proxy/v1/quit endpoints without the required header via server-side...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in virtualenv

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in virtualenv including OS Command Injection, CRLF Injection, and Download of Code Without Integrity Check. Virtualenv is used in our Speech Service Runtimes. These vulnerabilities have been addressed. Please read the...

CVE-2026-95719

An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without...

CVE-2026-95715

An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise...

CVE-2026-95713

An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data...

CVE-2026-95708

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying...

CVE-2026-95706

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying...

CVE-2026-95709

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying...