SAP NetWeaver OS Command Injection (3745182)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an OS command injection vulnerability as referenced in SAP Security Note 3745182: - SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls...

PT-2026-72121

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...

PT-2026-72088

Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...

PT-2026-76577

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description OS command injection is possible in the smart user tool. An MCP client can execute arbitrary shell commands with the privileges of the user running the server by providing a crafted...

PT-2026-71949

Name of the Vulnerable Software and Affected Versions Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA Description An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the MaxHops, Timeout, or Size arguments within the...

[R2] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities

R2 Security Center Version 6.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/13/2026 - 10:35 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components curl, underscoreJS were found to contain vulnerabilities, and updated...

GHSA-6J9G-8FXC-25HQ Duplicate Advisory: Flowise contains an unauthenticated sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gvv-qjj3-2p6g. This link is maintained to preserve external references. Original Description Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the...

GHSA-M6QW-4CW2-HM4M vulnerabilities

Vulnerabilities for packages: airflow...

Haiwell IoT Cloud HMI Gateway

ADVISORY SUMMARY Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

CVE-2026-73660: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

CVE-2026-73623: Improper Neutralization of Special Elements used in an OS Command

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

Vim < 9.2.0839 OS Command Injection (GHSA-r5v6-q6j8-8qw2)

The version of Vim installed on the remote host is prior to 9.2.0839. It is, therefore, affected by a vulnerability as referenced in the GHSA-r5v6-q6j8-8qw2 advisory. - The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled...

VulnCheck KEV: CVE-2025-55583

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a preapiarg parameter that is passed directly to system-level shell execution functions without...

Adobe ColdFusion 2023.x < 2023 Update 23 / 2025.x < 2025 Update 12 Multiple Vulnerabilities (APSB26-90)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 23 or 2025.x update 12. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-90 advisory. - Improper Neutralization of Special Elements used in an OS Command 'OS Command...

CVE-2026-73483: Improper Neutralization of Special Elements used in an OS Command

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

CVE-2026-73667: Improper Neutralization of Special Elements used in an OS Command

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

CVE-2026-17431: Improper Neutralization of Special Elements used in an OS Command

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...