CVE-2026-19243: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-19035

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

EUVD-2026-53867

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-15733: Improper Neutralization of Special Elements used in an OS Command

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

CVE-2026-19036: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument pppcustom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may...

PT-2026-68656

Name of the Vulnerable Software and Affected Versions WGDashboard versions prior to 4.2.4 Description An OS command injection issue allows authenticated attackers to execute arbitrary commands with root privileges on the system. This leads to Remote Code Execution RCE, which is the ability of an...

CVE-2026-19034: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

PT-2026-68480

Name of the Vulnerable Software and Affected Versions Shibby Tomato version 1.28.0000 Description A remote OS command injection flaw exists in the sub 40F88C function within the /tmp/ppp/wanoptions file. This issue occurs when the ppp custom argument is manipulated, allowing an attacker to execut...

PT-2026-68469

Name of the Vulnerable Software and Affected Versions Shibby Tomato version 1.28.0000 Description An OS command injection flaw exists in the new qoslimit start function located in the /etc/qoslimit file. A remote attacker can trigger this issue by manipulating the new qoslimit enable argument. OS...

PT-2026-68459

Name of the Vulnerable Software and Affected Versions Shibby Tomato version 1.28.0000 Description An OS command injection flaw exists in the new qoslimit stop function within the /tmp/qoslimittc stop.sh file. A remote attacker can exploit this by manipulating the wan iface argument to execute...

PT-2026-68606

Name of the Vulnerable Software and Affected Versions Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0 Description An OS Command Injection issue exists in the IAPI component. A remote unauthenticated attacker can exploit this to execute arbitrary operating...

CVE-2026-63725: Improper Neutralization of Special Elements used in an OS Command

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

PT-2026-68762

Name of the Vulnerable Software and Affected Versions sysPass affected versions not specified Description The doBackupFiles function in FileBackupService.php constructs a tar shell command by concatenating the backup directory path this-path directly into the command line without using...

CVE-2026-19035: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function newqoslimitstart of the file /etc/qoslimit. The manipulation of the argument newqoslimitenable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-67261: Improper Neutralization of Special Elements used in an OS Command

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...