179664 matches found
PT-2026-79249
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fai...
PT-2026-79171
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper privilege management may allow a local attacker to execute arbitrary commands. Recommendations At the moment, there is no information about a newer version that...
PT-2026-78899
Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0101 Description An OS command injection flaw exists due to insufficient input filtering. This allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands, which...
CVE-2026-18264: Improper Neutralization of Special Elements used in an OS Command
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...
CVE-2026-55769: Untrusted Search Path
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...
PT-2026-78997
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...
CVE-2026-18824: Improper Neutralization of Special Elements used in an OS Command
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-17142: Improper Authentication
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication...
CVE-2026-16932: Improper Neutralization of Special Elements used in an OS Command
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...
Debian dsa-6453 : libgit2-1.9 - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6453 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 [email protected] https://www.debian.org/securit...
CVE-2026-77004: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...
AlmaLinux 9 : pcp (ALSA-2026:55740)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55740 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PMDA...
PT-2026-79137
Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4 Description An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout occurs. This happens because the software reads SMTP comman...
RHEL 9 : dracut (RHSA-2026:57775)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57775 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...
PT-2026-79226
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper authentication in the system could allow a remote attacker to execute arbitrary commands. Recommendations At the moment, there is no information about a newer versi...
PT-2026-79055
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may ...
PT-2026-79136
Name of the Vulnerable Software and Affected Versions OTRS Community Edition affected versions not specified Description An authenticated OS command injection exists in the PGP encryption module. This issue occurs because configuration values provided by administrators are concatenated into a she...
Linux Distros Unpatched Vulnerability : CVE-2026-76221
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directiv...
CVE-2026-61898: Improper Neutralization of Special Elements used in an OS Command
The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...
D-Link DNS_340L Command Injection
Proof of concept exploit for a remote command injection vulnerability in various D-Link models. Exploit Title: D-Link DNS340L - OS Command Injection Date: 2026-07-16 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://www.dlink.com/ Version: DNS-320 v1.00, DNS-320LW v1.01.0914.2012,...