CVE-2026-76740: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : curl vulnerabilities (USN-8932-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8932-1 advisory. Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when...

Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

PT-2026-117682

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub 416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa...

PT-2026-117495

Name of the Vulnerable Software and Affected Versions Eptura Archibus versions prior to 2025.02 Description An unauthenticated arbitrary file upload issue allows attackers to upload files with any content, including JSP and JSPX scripts, via the export reports feature. Because these uploaded file...

CVE-2026-103038: Improper Neutralization of Special Elements used in an OS Command

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

CVE-2026-112195: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...

RHEL 10 : emacs (RHSA-2026:84591)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84591 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp...

AlmaLinux 9 : environment-modules (ALSA-2026:84594)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable ha...

SUSE CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

DEBIAN-CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

AZL-109304 CVE-2026-98828 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

UBUNTU-CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

UBUNTU-CVE-2026-98583

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98828

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

Jumpserver command injection vulnerability

Jumpserver 4.10.19 and earlier versions have a command injection vulnerability. This vulnerability stems from incorrect operations with parameters such as IP/HOST by the Template Rendering component, which may lead to OS command injections. Attackers can exploit this vulnerability remotely...

Alex Pasmantier Television Command Injection Vulnerability

Alex Pasmantier’s Television version 0.15.0 to 0.15.9 has a command injection vulnerability. This vulnerability stems from improper escaping of single quotes in the formatcommand function. An attacker can introduce a specially crafted file with names containing single quotes, allowing them to...

Eptura Archibus arbitrary file upload vulnerability

Versions of Eptura Archibus prior to 2025.02 contained a vulnerability related to arbitrary file upload. This vulnerability stemmed from the ability of users to upload exported reports containing arbitrary file content, specify arbitrary content, and upload JSP code with JSPX as the file extensio...

Semaphore UI input validation error vulnerability

Semaphore UI versions prior to 2.19.16 have a vulnerability in input validation. This vulnerability arises because users with the taskrunner role can provide arbitrary keys in the task environment JSON, thereby overriding protected Ansible variables. This allows them to set ansiblesshcommonargs’s...