CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

PYSEC-2026-3861 LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

PYSEC-2026-3862 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

CVE-2026-0302

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

CVE-2026-73570 — Zimbra zimbra-snmp Unauthenticated OS Command...

EUVD-2026-75270

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

CVE-2026-0302 Checkov by Prisma Cloud: OS Command Injection Vulnerability

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

CVE-2026-0302

CVE-2026-0302 is currently a reserved candidate with no public technical details available in the provided documents. Monitor for updates once the reserving organization publishes further information.

CVE-2026-0302 Checkov by Prisma Cloud: OS Command Injection Vulnerability

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

PT-2026-89642

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-88277: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root...

PT-2026-89595

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

PT-2026-89633

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An issue exists where a remote authenticated attacker can execute arbitrary code. This occurs due to improper neutralization of special elements used in an OS command, which allow...

CVE-2026-82099: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-89493

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-73693: Improper Neutralization of Special Elements used in an OS Command

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

PT-2026-89496

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

PT-2026-89497

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec sink unsanitized. Attackers can exploit this through an interactive path...