PT-2026-121588

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks against the affected interface of AOS-8. This flaw could lead to the execution of arbitrary commands on the underlying...

PT-2026-121639

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description Command injection flaws in the affected interface allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system. These commands ru...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a buffer overflow in the command-line interface. Under certain preconditions that allow attackers to exert control, this vulnerability may enable unauthenticated remote attackers to execute arbitrary commands on the underlying host and...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an authentication bypass flaw in affected interfaces. Under specific preconditions that are outside the attacker’s control, unauthenticated remote attackers can execute arbitrary commands on the underlying host. Exploitation of this...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a flaw in the command-line interface that allows sensitive information to be exposed. Unauthenticated remote attackers can exploit this vulnerability to gain access to such information. Successful exploitation may also grant them acces...

LXC Incus command injection vulnerability

Versions LXC Incus from 7.3.0 through 7.5.0 contain a command injection vulnerability. This vulnerability stems from the ability to bypass project restrictions; restricted project users can set block.createoptions via volume updates, copying, and moving operations. This allows them to trigger...

virtualenv Arbitrary Command Execution

The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

activate.sh Arbitrary Command Execution

The vulnerability in the activate.sh script src/virtualenv/activation/bash/activate.sh, a tool for creating isolated virtual environments in Python virtualenv, is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability could allow an attacker to...

PT-2026-121627

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A buffer overflow exists in a web interface endpoint of AOS-8 devices. An unauthenticated remote attacker can exploit this to execute arbitrary commands on the underlying operating system,...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a command injection flaw in the command-line interface accessed via the PAPI protocol. An attacker adjacent to the system can send specially crafted PAPI packets to UDP port 8211, thereby achieving unauthenticated remote code execution...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 10 contains a command injection vulnerability. This vulnerability arises from the lack of input validation when receiving specially crafted PAPI packets, potentially allowing unauthenticated remote code execution. Attackers can then execute arbitrary code as a privileged user on the...

PT-2026-121511

Name of the Vulnerable Software and Affected Versions AWS SAM CLI versions prior to 1.166.2 Description An OS command injection exists in the Terraform hook. An actor capable of influencing the Terraform configuration or plan file used during a build can execute arbitrary commands as the build us...

PT-2026-121636

Name of the Vulnerable Software and Affected Versions ArubaOS 8 affected versions not specified Description An issue in the CLI command handling of the AOS-8 web interface allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system. This could lead to...

PT-2026-121630

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A buffer overflow occurs in the command line interface, which may allow an unauthenticated remote attacker to execute arbitrary commands on the underlying host. This is possible if specific...

PT-2026-121398

Name of the Vulnerable Software and Affected Versions Z-Wave SDK versions prior to 8.1.2 Description A malformed NCP SPI command can trigger out-of-bounds reads, which may lead to the leakage of sensitive information. Out-of-bounds reads occur when a program reads data past the end of the intende...

PT-2026-121667

Name of the Vulnerable Software and Affected Versions Azure Pipelines affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At the momen...

openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:22142-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22142-1 advisory. Changes in yt-dlp: Update to version 2026.08.19: utils: floatornone: Catch OverflowError americastestkitchen: Fix season/series extraction apple: Rework...

PT-2026-121335

Name of the Vulnerable Software and Affected Versions Goose affected versions not specified Description A flaw exists when the terminal integration feature is enabled, causing the application to capture shell command history and send it without sanitization to configured Large Language Model LLM...

PT-2026-121584

Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description Authentication bypass flaws in the affected interface could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system if specific preconditions...

SUSE CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...