CVE-2026-81476: Improper Neutralization of Special Elements used in an OS Command

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote...

CVE-2026-53534: Improper Neutralization of Special Elements used in an OS Command

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-52483

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

Security Bulletin: Vulnerable Version of Software in Use (CVE-2026-5704)

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of tar. Vulnerability Details CVEID:CVE-2026-5704 DESCRIPTION: A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection wit...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-3805 DESCRIPTION: When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. CWE:CWE-416: U...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-20283

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

EUVD-2026-81140

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafte...

CVE-2026-20283 Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-20283

A command injection vulnerability in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The root cause is insufficient validation of user-supplied input in IPsec Open API ca...

CVE-2026-20283 Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-92398

A vulnerability was found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rgconfig/admin of the component userlistnote Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the...

CVE-2026-71179

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...

CVE-2026-92397

A vulnerability has been found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this vulnerability is the function ccset of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote...

CVE-2026-76104

Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-71179

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...

EUVD-2026-80862

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...