CVE-2026-76740 HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

EUVD-2026-104091

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

Important: Red Hat Security Advisory: emacs security update

An update for emacs is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

emacs: emacs: Command injection via crafted filenames in TRAMP

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Moderate: Red Hat Security Advisory: environment-modules security update

An update for environment-modules is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

MAL-2026-17927 Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

Cacti cmd_realtime.php - Command Injection

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...

GLPI <=10.0.2 - Remote Command Execution

GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...

CLSA-2026-1792174968 ruby: Fix of 19 CVEs

CVE-2026-42246: fix Net::IMAPstarttls returning success without TLS on a man-in-the-middle error response - CVE-2026-42258: fix IMAP command injection via Symbol arguments...

CVE-2026-108983

The GV-ASManager Web Server is vulnerable to a Command Injection vulnerability (CWE-78) within the GeoWebServer.exe process, specifically on the default connection ports. This flaw allows for the improper neutralization of special elements used in OS commands. The vulnerability is rated as CRITIC...

CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

CLSA-2026-1792167430 ruby: Fix of 20 CVEs

CVE-2026-42246: fix Net::IMAPstarttls returning success without TLS on a man-in-the-middle error response - CVE-2026-42258: fix IMAP command injection via Symbol arguments...

Palo Alto Networks PAN-OS GlobalProtect Command Injection

Palo Alto Networks PAN-OS GlobalProtect configurations contain an unauthenticated command injection vulnerability that can result in arbitrary file creation and root-level code execution...

PT-2026-117484

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been...

PT-2026-117521

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...

environment-modules security update

5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013...

Streamsoft PingTools Network Utilities command injection vulnerability

Streamsoft PingTools Network Utilities version 4.64 contains a command injection vulnerability. This vulnerability arises because the Host field in the Watcher ICMP service accepts arbitrary values and appends them to the command string executed via the sh -c command, potentially leading to comma...

HPE Compute Scale-up Server 3200 platform command injection vulnerability

The HPE Compute Scale-up Server 3200 platform versions prior to 1.77.30, the HPE Compute Scale-up Server 3250 platform versions prior to 1.03.38, the HPE Superdome Flex server versions prior to 4.17.03, and the HPE Superdome Flex 280 server versions prior to 2.17.03 contain a command injection...