193602 matches found
GHSA-G74G-RG72-J2P3 mise permits untrusted local configuration to override default shell arguments
Summary Untrusted local .mise.toml settings can set the shell interpreter args unix/windows defaultinline / defaultfile shellargs, yielding arbitrary command execution, because those command-interpreter settings were not added to the globalonly denylist the CVE-2026-55448 fix relies on. Code...
Security Bulletin: IBM Cognos Command Center has addressed vulnerabilities
Summary There are vulnerabilities in IBM Cognos Command Center. IBM Cognos Command Center 10.2.5 FP1 IF5 has addressed the applicable CVEs. Please refer to the table in the Related Information section for vulnerability impact. Vulnerability Details CVEID:CVE-2026-14963 DESCRIPTION: IBM Cognos...
CVE-2026-55240
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template, while the default evaluate pattern remains enabled. A workspace...
CVE-2026-111229
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability...
CVE-2026-111224
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes an...
CVE-2026-111226
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...
CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...
CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-111219
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...
CVE-2026-111217
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via...
CVE-2026-111214
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...
CVE-2026-111215
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...
CVE-2026-111216
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...
CVE-2026-111229
...
EUVD-2026-102341
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...
CVE-2026-111229
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...
CVE-2026-111229
pfSense CE versions 2.7.0 through 2.9.0 are vulnerable to a command injection flaw in services_captiveportal_hasync.php. An attacker with Captive Portal HA privileges can set backwardsyncip to a malicious XMLRPC server. This server can return connected_users data containing shell metacharacters i...
CVE-2026-111226
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...
CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...