PT-2026-102996

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations...

PT-2026-102999

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely...

PT-2026-103000

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

PT-2026-103015

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki capture source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has be...

AlmaLinux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.6:CLSA-2026:1789034846)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789034846 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacke...

CVE-2026-100254: Improper Neutralization of Special Elements used in an OS Command

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

PT-2026-103534

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...

CVE-2026-102096: Improper Neutralization of Special Elements used in an OS Command

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

Rocky Linux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.6:CLSA-2026:1789034846)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789034846 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an...

AlmaLinux 9.2 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients (ALMALINUX9.2:CLSA-2026:1789389842)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789389842 advisory. - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacke...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS-STREAM8:CLSA-2026:1779436673)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1779436673 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2022-51019

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

EUVD-2022-56062

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019

Akaunting versions prior to 2.1.31 are vulnerable to an OS command injection vulnerability within the module installation and update flow. The root cause is the unvalidated passing of the alias parameter to shell command execution. Authenticated users with admin panel access can exploit this by i...