CVE-2026-73294: Improper Neutralization of Special Elements used in an OS Command

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

CVE-2026-18235: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...

CVE-2026-73263: Improper Neutralization of Special Elements used in an OS Command

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

PT-2026-71273

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to properly sanitize inp...

CVE-2026-16956: Improper Neutralization of Special Elements used in an OS Command

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16906: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

PT-2026-71182

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command...

CVE-2026-17420: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL parameter...

PT-2026-71190

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote authenticated attacker can cause a denial of service due to improper neutralization of special elements in an OS command. This issue occurs when the system fails to properly sanitize input us...

CVE-2026-16695: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-18683: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands...

CVE-2026-73414: Improper Neutralization of Special Elements used in an OS Command

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-63298: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.' configuration...

PT-2026-71366

Name of the Vulnerable Software and Affected Versions PDF::WebKit versions through 1.2 Description OS command injection is possible when untrusted input is passed as the output path or as a stylesheet entry. The issue occurs because the to pdf function reads the generated PDF from its path...

CVE-2026-73412: Improper Neutralization of Special Elements used in an OS Command

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-49481: Improper Neutralization of Special Elements used in an OS Command

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...

PT-2026-71185

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities

Summary The IBM Db2 Mirror for i GUI is affected by multiple vulnerabilities CVE-2026-17186, CVE-2026-17184, CVE-2026-17182, CVE-2026-17181, CVE-2026-16879, CVE-2026-17179, CVE-2026-16915, CVE-2026-17175, CVE-2026-18554, CVE-2026-17079, CVE-2026-16905, CVE-2026-17227, CVE-2026-17209,...

CVE-2026-66150

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP...

CVE-2026-66149

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...